024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c

Analysis

max time kernel
182s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 01:25 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe
Size

548KB
MD5

4d6bc1d7974c06161e1ed65c7f0a20a8
SHA1

1a98ef9a70d39f916a81e0e8c9cf95c8c145744b
SHA256

024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c
SHA512

c2d1b78364de65346e64e0fd0bed87c4ab110de1e03705b68489503f5069053a647d478c7b0c5217cc8f9f40fe39deceb2c809a714a92ffc8c741d273799e5ee
SSDEEP

6144:tkAH0NoFM7OnNbxu3xWADqEenYqOzUHnjir1TApaBtDVFlQYnGLUHFop5Ny05dS7:trFBtfDcapaBtDpHFY+0+FskukB1Hd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	5056	WerFault.exe	78

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
3636	ipconfig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3636	5056	024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe	79
PID 5056 wrote to memory of 3636	5056	024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe	79
PID 5056 wrote to memory of 3636	5056	024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe	79

C:\Users\Admin\AppData\Local\Temp\024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe
"C:\Users\Admin\AppData\Local\Temp\024140fb411c120a4f7bdab9a46959b60da178910106bd0d73196a479243947c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /release
  2⤵
  - Gathers network information
  PID:3636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 1180
  2⤵
  - Program crash
  PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:3656

Network

DNS

151.122.125.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

151.122.125.40.in-addr.arpa

IN PTR

Response

178.79.208.1:80

104 B
2
87.248.202.1:80

260 B
5
52.109.13.63:443

40 B
1
72.21.91.29:80

46 B
40 B
1
1
52.178.17.3:443

322 B
7
178.79.208.1:80

322 B
7
178.79.208.1:80

322 B
7
8.238.23.254:80

46 B
40 B
1
1

8.8.8.8:53

151.122.125.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

151.122.125.40.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

DNS Request

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.