81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48

Analysis

max time kernel
155s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe
Size

33KB
MD5

b064f8da86db1c091e623781ab464d8a
SHA1

600dd091a46f83c0ff03f1e7bfda8f7c1cc4f312
SHA256

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48
SHA512

9e09d6f85874a40ff83f3641cdafe8ad50094f4d4007aae6a5248bac56f8301a9fc08fca65ae77f9fd735fbb6689059f3f435a9d42c1d37a0f59ee7b5f9b0e30
SSDEEP

384:VQpmKKS+jqtF92NceQkVKF8z1zbNjCxk8:gm1S+IONcf0hNj+r

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vuzbz.exe

pid process

5040 vuzbz.exe

pid	process
5040	vuzbz.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

description	pid	process	target process
PID 2224 wrote to memory of 5040	2224	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe	vuzbz.exe
PID 2224 wrote to memory of 5040	2224	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe	vuzbz.exe
PID 2224 wrote to memory of 5040	2224	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe	vuzbz.exe

C:\Users\Admin\AppData\Local\Temp\81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe
"C:\Users\Admin\AppData\Local\Temp\81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Local\Temp\vuzbz.exe
"C:\Users\Admin\AppData\Local\Temp\vuzbz.exe"
2⤵
- Executes dropped EXE
PID:5040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vuzbz.exe

Filesize
33KB

MD5
fede96c7249f0ca353987848b9066348

SHA1
b94a8a300dfe23787bc97df9c47a362c25a6159e

SHA256
93b573611cad6c4a87704eee4bde8ba0e8a0aa5ea504c5f2f815f495dccd524d

SHA512
20cf1e211b691228b3f0b5586d9ff43cb66f249e08e4f14b234c32fcbc39c6ffaef9088d59c6ce5e400a047aed0532eb2edee1162f48919bba38f27e8370b2b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\vuzbz.exe

Filesize
33KB

MD5
fede96c7249f0ca353987848b9066348

SHA1
b94a8a300dfe23787bc97df9c47a362c25a6159e

SHA256
93b573611cad6c4a87704eee4bde8ba0e8a0aa5ea504c5f2f815f495dccd524d

SHA512
20cf1e211b691228b3f0b5586d9ff43cb66f249e08e4f14b234c32fcbc39c6ffaef9088d59c6ce5e400a047aed0532eb2edee1162f48919bba38f27e8370b2b6

Download Submit
memory/2224-132-0x0000000000400000-0x00000000004149F0-memory.dmp

Filesize
82KB

Download
memory/2224-133-0x00000000009D0000-0x0000000000A8F000-memory.dmp

Filesize
764KB

Download
memory/2224-137-0x0000000000400000-0x00000000004149F0-memory.dmp

Filesize
82KB

Download
memory/5040-134-0x0000000000000000-mapping.dmp

Download
memory/5040-138-0x0000000000890000-0x00000000008A5000-memory.dmp

Filesize
84KB

Download
memory/5040-139-0x0000000000890000-0x00000000008A5000-memory.dmp

Filesize
84KB

Download