78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe
Size

1.6MB
MD5

f7db79f9191ae26d567c81f94cb5813b
SHA1

c40c7179ee64bdbb2f01accaefbb8bc65b92ca0d
SHA256

78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b
SHA512

c118b45e906361408624fb34aaed77379497925adfe69a0dc331b0c876621d50e80bb5166f3271d75acfe6b89850dd76af7fa3d7fce7da33299eb15e335b02d9
SSDEEP

49152:084cjNkF8pKG3iH4hKLthfGLqbt/kkpUazWh0:6cjNa03W4hKphfGLqZ/kZaz/

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3580 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3580	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe

description	pid	process	target process
PID 1000 wrote to memory of 3580	1000	78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe	regsvr32.exe
PID 1000 wrote to memory of 3580	1000	78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe	regsvr32.exe
PID 1000 wrote to memory of 3580	1000	78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe
"C:\Users\Admin\AppData\Local\Temp\78d21cd92bb4edb68b55e15e49b07d2481ba73c7994495f86c87b564c96fb34b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" .\QfYXKWG7.GOt /u /s
2⤵
- Loads dropped DLL
PID:3580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QfYXKWG7.GOt

Filesize
1.7MB

MD5
21231a8a79aab76e8da1b27112b9624c

SHA1
915f5ac6cc293151fd60864926e83d4521babd10

SHA256
bf1d4fdd35d1083396e56b5ac809635b6e60d7093c44a17ba0e8b08600635312

SHA512
363c42b303c4d61f9d91d5789946d0642c04ab0eb2413848512b1bd031240fcb1f250e901be84a08a34892ae676e0f651fee5a243637b2dde8d3aad96f6ebbda

Download Submit
C:\Users\Admin\AppData\Local\Temp\qfYXkWG7.Got

Filesize
1.7MB

MD5
21231a8a79aab76e8da1b27112b9624c

SHA1
915f5ac6cc293151fd60864926e83d4521babd10

SHA256
bf1d4fdd35d1083396e56b5ac809635b6e60d7093c44a17ba0e8b08600635312

SHA512
363c42b303c4d61f9d91d5789946d0642c04ab0eb2413848512b1bd031240fcb1f250e901be84a08a34892ae676e0f651fee5a243637b2dde8d3aad96f6ebbda

Download Submit
memory/3580-132-0x0000000000000000-mapping.dmp

Download
memory/3580-135-0x0000000002D80000-0x0000000002EBB000-memory.dmp

Filesize
1.2MB

Download
memory/3580-136-0x0000000002FE0000-0x00000000030F5000-memory.dmp

Filesize
1.1MB

Download
memory/3580-137-0x0000000002D80000-0x0000000002EBB000-memory.dmp

Filesize
1.2MB

Download
memory/3580-138-0x0000000003100000-0x00000000031C7000-memory.dmp

Filesize
796KB

Download
memory/3580-139-0x00000000031D0000-0x0000000003284000-memory.dmp

Filesize
720KB

Download
memory/3580-140-0x00000000031D0000-0x0000000003284000-memory.dmp

Filesize
720KB

Download
memory/3580-142-0x0000000002FE0000-0x00000000030F5000-memory.dmp

Filesize
1.1MB

Download