799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8

Analysis

max time kernel
96s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe
Size

1.7MB
MD5

09ece418a7c2de94bc5aa52362fd195e
SHA1

ab11b803f7815b6192c5c3ca068897e8ae3553e0
SHA256

799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8
SHA512

325e99b2f85253056e6471a7ae152bda1f382917fbdbe65a86609341d45a3edeaaf29e793db2f45954d7c366a2d5961ad979be2c1d49f8e337f816350274fd9d
SSDEEP

24576:YOfNkuu6oLsJ/k+jMk8bH9k0IR4V6pSIdOd0ldO/z4tl5AxOsVLi6yIiJr/BIJFS:H6MMKmH7IWrilcZxOa+xIiJ9KwI99U+G

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe

Loads dropped DLL 1 IoCs

Processes:

msiexec.exe

pid process

4932 msiexec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4932	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe

description	pid	process	target process
PID 2552 wrote to memory of 4932	2552	799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe	msiexec.exe
PID 2552 wrote to memory of 4932	2552	799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe	msiexec.exe
PID 2552 wrote to memory of 4932	2552	799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe
"C:\Users\Admin\AppData\Local\Temp\799b5c80650075ad1338e4223b6b40eeda33859f504ec8131c57773d9ed7ade8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" /Y .\WBtufN.XV
2⤵
- Loads dropped DLL
PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WBtufN.XV

Filesize
1.7MB

MD5
5a45971a42f27a580d292f24a03a4b59

SHA1
15a119ea9d53c008d168424ae70f0349624cefd6

SHA256
a413037c28fde6d27c1de47ab2ec1f4db9a3f8ce2cad3293c4ce2883b375c7fa

SHA512
48d18c0dd73b51e554b5e2036058a0f22089219b502b357a0851f403630ddda4063af0cc2fe27e308f133a4bd71802d1fab828e4c1a67649446ffbf7bc7b2dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\wBtufn.Xv

Filesize
1.7MB

MD5
5a45971a42f27a580d292f24a03a4b59

SHA1
15a119ea9d53c008d168424ae70f0349624cefd6

SHA256
a413037c28fde6d27c1de47ab2ec1f4db9a3f8ce2cad3293c4ce2883b375c7fa

SHA512
48d18c0dd73b51e554b5e2036058a0f22089219b502b357a0851f403630ddda4063af0cc2fe27e308f133a4bd71802d1fab828e4c1a67649446ffbf7bc7b2dde

Download Submit
memory/4932-132-0x0000000000000000-mapping.dmp

Download
memory/4932-135-0x0000000003050000-0x0000000003164000-memory.dmp

Filesize
1.1MB

Download
memory/4932-136-0x0000000003290000-0x00000000033A4000-memory.dmp

Filesize
1.1MB

Download
memory/4932-137-0x00000000033B0000-0x0000000003478000-memory.dmp

Filesize
800KB

Download
memory/4932-138-0x0000000002E60000-0x0000000002F13000-memory.dmp

Filesize
716KB

Download
memory/4932-141-0x0000000003290000-0x00000000033A4000-memory.dmp

Filesize
1.1MB

Download