79a5bf33292de397da4ba1becdbb5fba0ed6e2965db5926797c0b097cfd85a8c

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f2bd70fb3d3307b5a93c8f53fce80b8.exe
Size 1.5MB
Sample221121-k97d6sch23
SHA256 79a5bf33292de397da4ba1becdbb5fba0ed6e2965db5926797c0b097cfd85a8c
MD5 5f2bd70fb3d3307b5a93c8f53fce80b8
SHA1 d321f5d451a75b4a3e4486349f5cd8ba685c4c05
SHA512 805ba4b52d7001cd20984456de41434754cd22b8e44d4629672c4b5d31ecb4aafe69c5631e0343ddec54ccf385d745315f10bd5e7f4206cbb7a0abed3f22d948
SSDEEP 49152:gJ4NJ3UnywiDznh6qms9EWDblil+Kz9zs:gJ43Unyvzh6USWD5yz9zs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	5f2bd70fb3d3307b5a93c8f53fce80b8.exe

Loads dropped DLL 2 IoCs

pid	Process
4520	rundll32.exe
3456	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	5f2bd70fb3d3307b5a93c8f53fce80b8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4344	880	5f2bd70fb3d3307b5a93c8f53fce80b8.exe	83
PID 880 wrote to memory of 4344	880	5f2bd70fb3d3307b5a93c8f53fce80b8.exe	83
PID 880 wrote to memory of 4344	880	5f2bd70fb3d3307b5a93c8f53fce80b8.exe	83
PID 4344 wrote to memory of 4520	4344	control.exe	85
PID 4344 wrote to memory of 4520	4344	control.exe	85
PID 4344 wrote to memory of 4520	4344	control.exe	85
PID 4520 wrote to memory of 4420	4520	rundll32.exe	86
PID 4520 wrote to memory of 4420	4520	rundll32.exe	86
PID 4420 wrote to memory of 3456	4420	RunDll32.exe	87
PID 4420 wrote to memory of 3456	4420	RunDll32.exe	87
PID 4420 wrote to memory of 3456	4420	RunDll32.exe	87

C:\Users\Admin\AppData\Local\Temp\5f2bd70fb3d3307b5a93c8f53fce80b8.exe
"C:\Users\Admin\AppData\Local\Temp\5f2bd70fb3d3307b5a93c8f53fce80b8.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\W4ZLACKE.cPl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\W4ZLACKE.cPl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\W4ZLACKE.cPl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\W4ZLACKE.cPl",
        5⤵
        Loads dropped DLL
        
        PID:3456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

W4ZLACKE.cPl

Path C:\Users\Admin\AppData\Local\Temp\W4ZLACKE.cPl
Size 1.4MB
SHA256 04a36328ae5d3e7850565e183cf7ddb602c5ede120ef5c6e9a63ad0f493a0961
MD5 930941cdbd0232f309b9fde84b7b96bd
SHA1 a48009e0947112be1b27363b18540961254cab1b
SHA512 3b5c8c6120ab936d28bb574edf4732ac0f3205883b9b7ea1bac569e9b94712823977fa1b26b25e320289493274cc7d1651c10bc7918b4b9b9ba3a2eee56dcea1
SSDEEP 24576:2UR/uworgwvwY3fUc0jk7mdcYB9Jz0D0JDTtqHQ+b622rJbXyq8UWbhucKcw3cw:2Skg+zPUZLV00JDTtqF8rJbiq5Uhaz3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

W4ZLaCkE.cpl

Path C:\Users\Admin\AppData\Local\Temp\W4ZLaCkE.cpl
Size 1.4MB
SHA256 04a36328ae5d3e7850565e183cf7ddb602c5ede120ef5c6e9a63ad0f493a0961
MD5 930941cdbd0232f309b9fde84b7b96bd
SHA1 a48009e0947112be1b27363b18540961254cab1b
SHA512 3b5c8c6120ab936d28bb574edf4732ac0f3205883b9b7ea1bac569e9b94712823977fa1b26b25e320289493274cc7d1651c10bc7918b4b9b9ba3a2eee56dcea1
SSDEEP 24576:2UR/uworgwvwY3fUc0jk7mdcYB9Jz0D0JDTtqHQ+b622rJbXyq8UWbhucKcw3cw:2Skg+zPUZLV00JDTtqF8rJbiq5Uhaz3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

W4ZLaCkE.cpl

Path C:\Users\Admin\AppData\Local\Temp\W4ZLaCkE.cpl
Size 1.4MB
SHA256 04a36328ae5d3e7850565e183cf7ddb602c5ede120ef5c6e9a63ad0f493a0961
MD5 930941cdbd0232f309b9fde84b7b96bd
SHA1 a48009e0947112be1b27363b18540961254cab1b
SHA512 3b5c8c6120ab936d28bb574edf4732ac0f3205883b9b7ea1bac569e9b94712823977fa1b26b25e320289493274cc7d1651c10bc7918b4b9b9ba3a2eee56dcea1
SSDEEP 24576:2UR/uworgwvwY3fUc0jk7mdcYB9Jz0D0JDTtqHQ+b622rJbXyq8UWbhucKcw3cw:2Skg+zPUZLV00JDTtqF8rJbiq5Uhaz3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3456-152-0x00000000033A0000-0x00000000034B7000-memory.dmp

Download

memory/3456-149-0x0000000003590000-0x0000000003646000-memory.dmp

Download

memory/3456-148-0x00000000034C0000-0x0000000003589000-memory.dmp

Download

memory/3456-146-0x0000000003140000-0x000000000327F000-memory.dmp

Download

memory/3456-147-0x00000000033A0000-0x00000000034B7000-memory.dmp

Download

memory/4520-145-0x0000000003710000-0x0000000003827000-memory.dmp

Download

memory/4520-139-0x0000000003830000-0x00000000038E6000-memory.dmp

Download

memory/4520-138-0x0000000002D50000-0x0000000002E19000-memory.dmp

Download

memory/4520-137-0x0000000003710000-0x0000000003827000-memory.dmp

Download

memory/4520-136-0x00000000034B0000-0x00000000035EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads