07e699981daaca11fcde824dde139152a506e111c578893c6c3afb1916c85462

Analysis

max time kernel
85s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wvnnidru.bmp
Size

2.1MB
MD5

aff7f1e33647fab087d3e786a5b37daa
SHA1

935df62ce1567e02d7b6604b559d37eaa5c32c63
SHA256

07e699981daaca11fcde824dde139152a506e111c578893c6c3afb1916c85462
SHA512

50eb29f557e7debf1fce43ff9b21cd7323371373ce5d808b77a0b04f3989b94a9da101b2c867f86f730bed2416ded5ecd28627d5662d871106b9e474991ab04e
SSDEEP

24576:G5W1ixGx2xR8rwcKlaOgIRiSGX5BIC1wkt6qzLReHxOka3XrpXjJA/FWfAbJWXWz:zUrre5b3ooqa9tamW/MxwqM2JG8o

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation cmd.exe
Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mspaint.exe

pid process

1788 mspaint.exe
1788 mspaint.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

mspaint.exe

pid process

1788 mspaint.exe
1788 mspaint.exe
1788 mspaint.exe
1788 mspaint.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3076 wrote to memory of 1788 3076 cmd.exe mspaint.exe
PID 3076 wrote to memory of 1788 3076 cmd.exe mspaint.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	cmd.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings	cmd.exe

pid	process
1788	mspaint.exe
1788	mspaint.exe

pid	process
1788	mspaint.exe
1788	mspaint.exe
1788	mspaint.exe
1788	mspaint.exe

description	pid	process	target process
PID 3076 wrote to memory of 1788	3076	cmd.exe	mspaint.exe
PID 3076 wrote to memory of 1788	3076	cmd.exe	mspaint.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Wvnnidru.bmp
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Wvnnidru.bmp"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-133-0x0000000000000000-mapping.dmp

Download