40335fc69c45b3fefab11dfd6e562fbdcb2f2153ced916ddc68f44eecaab3d72

Analysis

max time kernel
154s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2022, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03fe82e54ce8f863a4a52ebba3d9eddd.exe
Size 2.1MB
Sample221116-wr2xhscc63
SHA256 40335fc69c45b3fefab11dfd6e562fbdcb2f2153ced916ddc68f44eecaab3d72
MD5 03fe82e54ce8f863a4a52ebba3d9eddd
SHA1 f82730129624648bc1a459935ab1b21e902e55f6
SHA512 85b26703e9262200878253446f3aa49f15c4007e9ca48c678ef3dccacd452372c0a1643262c38bb3aeebcc3378479a8cf7a50ee46910fd65467da9ac287b0acf
SSDEEP 49152:TlBfJXAEG+GSF4jgZFtUjW/vhJIdPubDK6jU1w+uqjkHmaiM:TlBfKE7VbUa/vYRUDK6j+VQxd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	03fe82e54ce8f863a4a52ebba3d9eddd.exe

Loads dropped DLL 2 IoCs

pid	Process
876	rundll32.exe
1036	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	03fe82e54ce8f863a4a52ebba3d9eddd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2912	836	03fe82e54ce8f863a4a52ebba3d9eddd.exe	80
PID 836 wrote to memory of 2912	836	03fe82e54ce8f863a4a52ebba3d9eddd.exe	80
PID 836 wrote to memory of 2912	836	03fe82e54ce8f863a4a52ebba3d9eddd.exe	80
PID 2912 wrote to memory of 876	2912	control.exe	82
PID 2912 wrote to memory of 876	2912	control.exe	82
PID 2912 wrote to memory of 876	2912	control.exe	82
PID 876 wrote to memory of 1924	876	rundll32.exe	83
PID 876 wrote to memory of 1924	876	rundll32.exe	83
PID 1924 wrote to memory of 1036	1924	RunDll32.exe	84
PID 1924 wrote to memory of 1036	1924	RunDll32.exe	84
PID 1924 wrote to memory of 1036	1924	RunDll32.exe	84

C:\Users\Admin\AppData\Local\Temp\03fe82e54ce8f863a4a52ebba3d9eddd.exe
"C:\Users\Admin\AppData\Local\Temp\03fe82e54ce8f863a4a52ebba3d9eddd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\5mR~.CPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5mR~.CPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5mR~.CPL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\5mR~.CPL",
        5⤵
        Loads dropped DLL
        
        PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5mR~.CPL

Path C:\Users\Admin\AppData\Local\Temp\5mR~.CPL
Size 2.2MB
SHA256 2d6b906cb7a809febd158d44d40bdd86bcb4b609e1c402a31bf56d5575a11e41
MD5 5473caec403f6c47f3375f11f84a23e2
SHA1 d0989332f1b45556acf07daf38d064e3d532da65
SHA512 ef27a2cc88d7d9efbd24194afc85b6c99843a5767380a45bf533bf91ad032f93c7251c3c792b2ab8a4955b89f10a6a728a1a255dc38a624c8e9cb6114a96d5ea
SSDEEP 24576:lA0GTk/K1laXuFX11YJik/1/SvoVQ6pcKVJ9o2E3a2gvGDVMdN2A9/i13E6o5/ZW:l+14+1SikNVQ+C5gvxt9Ou5R22z7CD
MD5 SHA1 SHA512 SSDEEP

Submit Download

5mR~.cpl

Path C:\Users\Admin\AppData\Local\Temp\5mR~.cpl
Size 2.2MB
SHA256 2d6b906cb7a809febd158d44d40bdd86bcb4b609e1c402a31bf56d5575a11e41
MD5 5473caec403f6c47f3375f11f84a23e2
SHA1 d0989332f1b45556acf07daf38d064e3d532da65
SHA512 ef27a2cc88d7d9efbd24194afc85b6c99843a5767380a45bf533bf91ad032f93c7251c3c792b2ab8a4955b89f10a6a728a1a255dc38a624c8e9cb6114a96d5ea
SSDEEP 24576:lA0GTk/K1laXuFX11YJik/1/SvoVQ6pcKVJ9o2E3a2gvGDVMdN2A9/i13E6o5/ZW:l+14+1SikNVQ+C5gvxt9Ou5R22z7CD
MD5 SHA1 SHA512 SSDEEP

Submit Download

5mR~.cpl

Path C:\Users\Admin\AppData\Local\Temp\5mR~.cpl
Size 2.2MB
SHA256 2d6b906cb7a809febd158d44d40bdd86bcb4b609e1c402a31bf56d5575a11e41
MD5 5473caec403f6c47f3375f11f84a23e2
SHA1 d0989332f1b45556acf07daf38d064e3d532da65
SHA512 ef27a2cc88d7d9efbd24194afc85b6c99843a5767380a45bf533bf91ad032f93c7251c3c792b2ab8a4955b89f10a6a728a1a255dc38a624c8e9cb6114a96d5ea
SSDEEP 24576:lA0GTk/K1laXuFX11YJik/1/SvoVQ6pcKVJ9o2E3a2gvGDVMdN2A9/i13E6o5/ZW:l+14+1SikNVQ+C5gvxt9Ou5R22z7CD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/876-136-0x00000000030F0000-0x0000000003273000-memory.dmp

Download

memory/876-137-0x00000000033A0000-0x00000000034BD000-memory.dmp

Download

memory/876-138-0x00000000034C0000-0x000000000358A000-memory.dmp

Download

memory/876-139-0x0000000003590000-0x0000000003646000-memory.dmp

Download

memory/876-152-0x00000000033A0000-0x00000000034BD000-memory.dmp

Download

memory/1036-146-0x0000000003570000-0x000000000368D000-memory.dmp

Download

memory/1036-145-0x00000000032C0000-0x0000000003443000-memory.dmp

Download

memory/1036-147-0x00000000036A0000-0x000000000376A000-memory.dmp

Download

memory/1036-148-0x0000000003780000-0x0000000003836000-memory.dmp

Download

memory/1036-151-0x0000000003570000-0x000000000368D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads