bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912

Analysis

max time kernel
175s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe
Size

879KB
MD5

1ce16812d9fe060307b3efdb75b16929
SHA1

3db6dc2eb56b794e7b943688640605f62dce0314
SHA256

bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912
SHA512

ed485f766f9027464bc441bc1c38401889aa38cd602409a19c07a54bfc582753d01b607631382e9298603aac0ddb30187b46a74e0c8a0996efba75ed4bae8e18
SSDEEP

12288:qat0EAH49n8BqByODm186QdHSP6HUb/avqOewPXkUXGB86k4GQSncwFuR9c2/N4v:lt24ZFDmKrSPQHTXkUXGi60/cwUR+v

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

2.exe1.exe

pid process

1372 2.exe
3628 1.exe

pid	process
1372	2.exe
3628	1.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe	upx
behavioral2/memory/3628-139-0x0000000000400000-0x0000000000657000-memory.dmp	upx
behavioral2/memory/3628-140-0x0000000000400000-0x0000000000657000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3148 1372 WerFault.exe 2.exe

pid	pid_target	process	target process
3148	1372	WerFault.exe	2.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe

description	pid	process	target process
PID 4476 wrote to memory of 1372	4476	bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe	2.exe
PID 4476 wrote to memory of 1372	4476	bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe	2.exe
PID 4476 wrote to memory of 1372	4476	bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe	2.exe
PID 4476 wrote to memory of 3628	4476	bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe	1.exe
PID 4476 wrote to memory of 3628	4476	bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe	1.exe
PID 4476 wrote to memory of 3628	4476	bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe	1.exe

C:\Users\Admin\AppData\Local\Temp\bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe
"C:\Users\Admin\AppData\Local\Temp\bd115d081031665e37b566d458472e5ff850d0f794f0d580233efe5ae0aef912.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4476

C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe"
2⤵
- Executes dropped EXE
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 1216
3⤵
- Program crash
PID:3148

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe"
2⤵
- Executes dropped EXE
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1372 -ip 1372
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe

Filesize
761KB

MD5
1c35df8d8dc305a36ff28727515b49b1

SHA1
d89603204bb8c53ad7ee3bb83f93f33f5ce3b55c

SHA256
9ae3337f81d35de0385676f666ad1cddefc4200a362f257311cad1df335df1af

SHA512
1a7b75ee39ede335bf4f2edd0b6eef95ba64c00016b737e25b09940c7eeede3b3b153879e3057f6be2d79eb0534bdf74a834eaacf1d92eaeb3c413d14098ec26

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.exe

Filesize
761KB

MD5
1c35df8d8dc305a36ff28727515b49b1

SHA1
d89603204bb8c53ad7ee3bb83f93f33f5ce3b55c

SHA256
9ae3337f81d35de0385676f666ad1cddefc4200a362f257311cad1df335df1af

SHA512
1a7b75ee39ede335bf4f2edd0b6eef95ba64c00016b737e25b09940c7eeede3b3b153879e3057f6be2d79eb0534bdf74a834eaacf1d92eaeb3c413d14098ec26

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe

Filesize
6KB

MD5
498c24826d02ada78fe8cf90a6cbc332

SHA1
d0d3163f372009d199ad9c2030489e7f3feb0706

SHA256
a1c6709fd507ab781c74c4b01fc48a5481d8b0dc492b4635d8d4c9309d642a4b

SHA512
fbc57ac4f38ca814fe28d2abab812232de8256047ff3f603010840e238cf5c01ec54804f52fb59a847c03cfa09069aa23065f8da4b29f5a5bb889d90037b69c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.exe

Filesize
6KB

MD5
498c24826d02ada78fe8cf90a6cbc332

SHA1
d0d3163f372009d199ad9c2030489e7f3feb0706

SHA256
a1c6709fd507ab781c74c4b01fc48a5481d8b0dc492b4635d8d4c9309d642a4b

SHA512
fbc57ac4f38ca814fe28d2abab812232de8256047ff3f603010840e238cf5c01ec54804f52fb59a847c03cfa09069aa23065f8da4b29f5a5bb889d90037b69c5

Download Submit
memory/1372-132-0x0000000000000000-mapping.dmp

Download
memory/1372-135-0x0000000000D00000-0x0000000000D08000-memory.dmp

Filesize
32KB

Download
memory/3628-136-0x0000000000000000-mapping.dmp

Download
memory/3628-139-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/3628-140-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download