f44ebade58a3b184c41f1e6b79782ed30babef8d2cee8040c2d83ab6dc76207f

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.exe
Size

176KB
MD5

eebfdbc8bf820a7751f02050b0f5cd16
SHA1

721db8bf3778570d6cd18fb749030ce99704d094
SHA256

8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39
SHA512

aaa37c396de5e3bdc7ef2c5ce620646192349953f7fbf7dedcdb0f3d81c24b33a6ef05a5d501c08f58df86f1fd0356ee902fccd24da20c9c5ae90aa87c15cf3f
SSDEEP

3072:tsGkrEM7aAMll8bqndiaxemXELx9HRkF/aZNJosLtFLFEKWP1Ih:+V7El8bIdia50TzNJoUHLCl

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Wbem.exe

pid process

1200 Wbem.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation .exe

pid	process
1200	Wbem.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Wbem.exe\""	.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

.exe

description pid process target process

PID 4972 wrote to memory of 1200 4972 .exe Wbem.exe
PID 4972 wrote to memory of 1200 4972 .exe Wbem.exe

description	pid	process	target process
PID 4972 wrote to memory of 1200	4972	.exe	Wbem.exe
PID 4972 wrote to memory of 1200	4972	.exe	Wbem.exe

C:\Users\Admin\AppData\Local\Temp\.exe
"C:\Users\Admin\AppData\Local\Temp\.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Wbem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Wbem.exe"
2⤵
- Executes dropped EXE
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\win32host.sys

Filesize
119B

MD5
96495c2922103ac9be9c1882b80f8d70

SHA1
34cc695b8ebdac78b9549655c03efb4a76cb1481

SHA256
dd47fb72d41f710b8ec6c2b302e280925952b2156e7afa4e0d1d5ac8a4f8793a

SHA512
983252a7136c1b260258a64b454fc241422ebc4a5bf4c3a93c57c5bc33b7dfeb96399f9ca424964142b1cb2c7b7a51df5539aaaffa043487349576d739d2ddfc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Wbem.exe

Filesize
176KB

MD5
eebfdbc8bf820a7751f02050b0f5cd16

SHA1
721db8bf3778570d6cd18fb749030ce99704d094

SHA256
8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39

SHA512
aaa37c396de5e3bdc7ef2c5ce620646192349953f7fbf7dedcdb0f3d81c24b33a6ef05a5d501c08f58df86f1fd0356ee902fccd24da20c9c5ae90aa87c15cf3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Wbem.exe

Filesize
176KB

MD5
eebfdbc8bf820a7751f02050b0f5cd16

SHA1
721db8bf3778570d6cd18fb749030ce99704d094

SHA256
8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39

SHA512
aaa37c396de5e3bdc7ef2c5ce620646192349953f7fbf7dedcdb0f3d81c24b33a6ef05a5d501c08f58df86f1fd0356ee902fccd24da20c9c5ae90aa87c15cf3f

Download Submit
memory/1200-133-0x0000000000000000-mapping.dmp

Download
memory/1200-136-0x00007FF995840000-0x00007FF996276000-memory.dmp

Filesize
10.2MB

Download
memory/4972-132-0x00007FF995840000-0x00007FF996276000-memory.dmp

Filesize
10.2MB

Download