Overview

overview

8

Static

static

6b2123edf5...a6.exe

windows7-x64

8

6b2123edf5...a6.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6b2123edf515bacf86af54f2a8c4fe502225c5de5c7999019509766c76a3b1a6.exe

  • Size

    152KB

  • MD5

    ec66689ac5a42348c179ff024d12fbbd

  • SHA1

    629e0634cad31a76ecb926020a16e5b870410243

  • SHA256

    6b2123edf515bacf86af54f2a8c4fe502225c5de5c7999019509766c76a3b1a6

  • SHA512

    2586868b90eb7082e0813c6f04853e2e833d7bcaa0f4e2a82294f287d3d484b5a95a77de328b4bb30868254a8c3129259be31e9452daf1ae22d33392ceee3b25

  • SSDEEP

    3072:QTqbAhrG9obJ6MEaviHQDIR+QsKvi5gndT5ql:iRGIvcZ+QsK65gnd

Score
8/10
persistence

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b2123edf515bacf86af54f2a8c4fe502225c5de5c7999019509766c76a3b1a6.exe
    "C:\Users\Admin\AppData\Local\Temp\6b2123edf515bacf86af54f2a8c4fe502225c5de5c7999019509766c76a3b1a6.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Windows\SysWOW64\regedt32.exe
      "C:\Windows\System32\regedt32.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\regedit.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
        3⤵
        • Runs .reg file with regedit
        PID:3636
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 1252
      2⤵
      • Loads dropped DLL
      • Program crash
      PID:848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 1012
      2⤵
      • Loads dropped DLL
      • Program crash
      PID:2176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 364 -ip 364
    1⤵
    • Loads dropped DLL
    PID:3048
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 364 -ip 364
    1⤵
    • Loads dropped DLL
    PID:3392

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\Iterra\T03emp03.reg
    Filesize

    217B

    MD5

    990914e119c0ccec13f271fc94b9b010

    SHA1

    5cb582600610865d569d77ed67f3ca02b5bac736

    SHA256

    2cb5b11afb2451eaf91ff4575e8c0bff4fbf881fbe0ae0eb6f6752ccb0b5a250

    SHA512

    42a0edfcb77802a864cf9c49992d7b54b6ccf05a86310a7c473c6b95b39d00871f9f62f49e754d4bb3d5959a173a0929bfea25fea726fae8d041bcdb3c2d0d79

    Download Submit

  • C:\Users\Admin\Documents\Iterra\djjqdme.dll
    Filesize

    42KB

    MD5

    39c4f5c81741cde4bb2ec25f10c59519

    SHA1

    43342091753a2f7ad3b3c733faba2c692197989d

    SHA256

    7c1eafe2a561d1db817bc43aaaa53c1164f4ac88e5b542e8d44f606ac2ea3115

    SHA512

    27bb09103df3ca29844de1bc981d901f49a26532e4a6b5e3e267fdaf4e00a56a152175370f2f69b4d7eba7ecf441dffe06eedcf572f23ad27852583636c72f45

    Download Submit

  • C:\Users\Admin\Documents\Iterra\djjqdme.dll
    Filesize

    42KB

    MD5

    39c4f5c81741cde4bb2ec25f10c59519

    SHA1

    43342091753a2f7ad3b3c733faba2c692197989d

    SHA256

    7c1eafe2a561d1db817bc43aaaa53c1164f4ac88e5b542e8d44f606ac2ea3115

    SHA512

    27bb09103df3ca29844de1bc981d901f49a26532e4a6b5e3e267fdaf4e00a56a152175370f2f69b4d7eba7ecf441dffe06eedcf572f23ad27852583636c72f45

    Download Submit

  • C:\Users\Admin\Documents\Iterra\djjqdme.dll
    Filesize

    42KB

    MD5

    39c4f5c81741cde4bb2ec25f10c59519

    SHA1

    43342091753a2f7ad3b3c733faba2c692197989d

    SHA256

    7c1eafe2a561d1db817bc43aaaa53c1164f4ac88e5b542e8d44f606ac2ea3115

    SHA512

    27bb09103df3ca29844de1bc981d901f49a26532e4a6b5e3e267fdaf4e00a56a152175370f2f69b4d7eba7ecf441dffe06eedcf572f23ad27852583636c72f45

    Download Submit

  • C:\Users\Admin\Documents\Iterra\djjqdme.dll
    Filesize

    42KB

    MD5

    39c4f5c81741cde4bb2ec25f10c59519

    SHA1

    43342091753a2f7ad3b3c733faba2c692197989d

    SHA256

    7c1eafe2a561d1db817bc43aaaa53c1164f4ac88e5b542e8d44f606ac2ea3115

    SHA512

    27bb09103df3ca29844de1bc981d901f49a26532e4a6b5e3e267fdaf4e00a56a152175370f2f69b4d7eba7ecf441dffe06eedcf572f23ad27852583636c72f45

    Download Submit

  • C:\Users\Admin\Documents\Iterra\djjqdme.dll
    Filesize

    42KB

    MD5

    39c4f5c81741cde4bb2ec25f10c59519

    SHA1

    43342091753a2f7ad3b3c733faba2c692197989d

    SHA256

    7c1eafe2a561d1db817bc43aaaa53c1164f4ac88e5b542e8d44f606ac2ea3115

    SHA512

    27bb09103df3ca29844de1bc981d901f49a26532e4a6b5e3e267fdaf4e00a56a152175370f2f69b4d7eba7ecf441dffe06eedcf572f23ad27852583636c72f45

    Download Submit

  • memory/364-138-0x0000000003080000-0x0000000003153000-memory.dmp

    Filesize

    844KB

    Download

  • memory/364-139-0x0000000003080000-0x0000000003153000-memory.dmp

    Filesize

    844KB

    Download

  • memory/364-132-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/364-133-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/364-144-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download