1ae013d4e99c5bc1b818e14963f275caada1f71fa0186834dc7680124aea8b8d

Analysis

max time kernel
103s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2022, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 923KB
Sample221116-tf7yaaca29
SHA256 1ae013d4e99c5bc1b818e14963f275caada1f71fa0186834dc7680124aea8b8d
MD5 964da73180a995495797e2107c4b936a
SHA1 d941ec8cb8d06c07f77d1c5318abeda5f23ab730
SHA512 6252c809c8aefa1ef8c6742a3099970c6af178a878eba3dd9ef557df62ce6903b9ccf00be534d2b9c1f9b8ffdb4cceed8cc6e5b257b2abe7efcd0a155fe7efa7
SSDEEP 3072:RSYXGw6CPL8ps6U3vUAlBlbusYkt2OET23p8zZbni72qlGqG111JvXy0RhPZKwCt:RSYXecod0CT632hi72qlS11dXY7H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1700	rundll32.exe	17

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	file.exe

Loads dropped DLL 1 IoCs

pid	Process
3664	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5036	3664	WerFault.exe	83

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 5084	4808	file.exe	80
PID 4808 wrote to memory of 5084	4808	file.exe	80
PID 4808 wrote to memory of 5084	4808	file.exe	80
PID 2884 wrote to memory of 3664	2884	rundll32.exe	83
PID 2884 wrote to memory of 3664	2884	rundll32.exe	83
PID 2884 wrote to memory of 3664	2884	rundll32.exe	83

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe" -q
  2⤵
  PID:5084

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 600
    3⤵
    - Program crash
    PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3664 -ip 3664
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 557KB
SHA256 556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860
MD5 76c3dbb1e9fea62090cdf53dadcbe28e
SHA1 d44b32d04adc810c6df258be85dc6b62bd48a307
SHA512 de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b
SSDEEP 12288:FV1e0UgkVT6ZT+3JCnoxgLMoCXwbePLJrH8fwpj:FV1edgkV8T0Cnoxt4ePLJTMwpj
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 3d73e4425bb7294f20ef86096504ab96d288bd70d2bc6a8361b629903f3b1d01
MD5 845a5f94673e266f80fae41538a94db1
SHA1 a8ed5ba958b94eb55a44f20a4791a58b76e91f0c
SHA512 f01450a61a6b2daec92fab31c9f153c76574f169f3fef2c6d0cf9283cf730a099c9b7c0cbc4ac44cc4d3c067565a49b8135aa85b745ea340a9d5f8c9dc5c3f81
SSDEEP 768:SJZtqsi21F/i//PzxH08AZhEZYamtVtBFw8:SRD89H087CtBW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 3d73e4425bb7294f20ef86096504ab96d288bd70d2bc6a8361b629903f3b1d01
MD5 845a5f94673e266f80fae41538a94db1
SHA1 a8ed5ba958b94eb55a44f20a4791a58b76e91f0c
SHA512 f01450a61a6b2daec92fab31c9f153c76574f169f3fef2c6d0cf9283cf730a099c9b7c0cbc4ac44cc4d3c067565a49b8135aa85b745ea340a9d5f8c9dc5c3f81
SSDEEP 768:SJZtqsi21F/i//PzxH08AZhEZYamtVtBFw8:SRD89H087CtBW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads