e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2022, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.5MB
Sample221112-v6kfcaca2x
SHA256 e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094
MD5 fd31f10421c89f733fdbeace88e3581e
SHA1 d52ff0233ce498c16e3f043ed7bf01259ffba82b
SHA512 5454daf2c114d723b572cafc09cc1ec2d9f2c822714527f3a0d7ef1ba3ff266cc5067f996d9fdb1c24c61e6fb5e577c3f3e55ceb1a6290e6a9f6e015d79d8224
SSDEEP 24576:QTbBv5rUwXVr7zGVBNE6THIsbkowLYTxR5kacOSYUKaMAJ2M7WKRKQAngV:CBDrcfE6TtbkwT5Oh9Mc2M7WKRKHI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	file.exe

Loads dropped DLL 3 IoCs

pid	Process
3392	rundll32.exe
3728	rundll32.exe
3728	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	file.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 564	3352	file.exe	80
PID 3352 wrote to memory of 564	3352	file.exe	80
PID 3352 wrote to memory of 564	3352	file.exe	80
PID 564 wrote to memory of 3392	564	control.exe	82
PID 564 wrote to memory of 3392	564	control.exe	82
PID 564 wrote to memory of 3392	564	control.exe	82
PID 3392 wrote to memory of 4576	3392	rundll32.exe	86
PID 3392 wrote to memory of 4576	3392	rundll32.exe	86
PID 4576 wrote to memory of 3728	4576	RunDll32.exe	87
PID 4576 wrote to memory of 3728	4576	RunDll32.exe	87
PID 4576 wrote to memory of 3728	4576	RunDll32.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\X5POy.cpL",
        5⤵
        Loads dropped DLL
        
        PID:3728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

X5POy.cpL

Path C:\Users\Admin\AppData\Local\Temp\X5POy.cpL
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path C:\Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path C:\Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

X5Poy.cpl

Path C:\Users\Admin\AppData\Local\Temp\X5Poy.cpl
Size 2.2MB
SHA256 8d16c86cf29eb31ef352ffd90e54af9f9b5341c7dccb2d296caa43588a8f822e
MD5 7ee3ddaa584fb02f1949517c51499af2
SHA1 3bff563cfd465090a551322358db4af8ff7ad963
SHA512 1e55098f104496bda354f0db90089b48e996b7f27265ff4f05d05b06cdd7dfb88e995ed21ae3b7b40dfb60dccb2aaacd57177e905acc235d740df28da18f6cc9
SSDEEP 24576:/NpG7uvu9ULBIUtEm8E2M9CQYdPGDDwYDoN9J9Gl2uCxPVOS5:/NJ1LBIUtEm8KCQYFGDDwOEi2lQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3392-136-0x0000000002DA0000-0x0000000002F69000-memory.dmp

Download

memory/3392-137-0x0000000003060000-0x000000000314C000-memory.dmp

Download

memory/3392-138-0x0000000003150000-0x0000000003219000-memory.dmp

Download

memory/3392-139-0x0000000003220000-0x00000000032D5000-memory.dmp

Download

memory/3392-140-0x0000000003220000-0x00000000032D5000-memory.dmp

Download

memory/3392-149-0x0000000003060000-0x000000000314C000-memory.dmp

Download

memory/3728-146-0x0000000002790000-0x00000000029C6000-memory.dmp

Download

memory/3728-147-0x0000000002CF0000-0x0000000002EB9000-memory.dmp

Download

memory/3728-148-0x0000000002FB0000-0x000000000309C000-memory.dmp

Download

memory/3728-150-0x00000000030A0000-0x0000000003169000-memory.dmp

Download

memory/3728-152-0x0000000003170000-0x0000000003225000-memory.dmp

Download

memory/3728-154-0x0000000002FB0000-0x000000000309C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads