57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f

Analysis

max time kernel
66s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2022, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8df4f501adfc1e0b5d108f123a79483.exe
Size 1.6MB
Sample221218-jnpfssba48
SHA256 57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f
MD5 b8df4f501adfc1e0b5d108f123a79483
SHA1 188d51bf71c161caea0b77f1b64d205514539ce7
SHA512 f70c96024acc4c4143d3838aa7444d21c3bdcf0b58c3711a87f986fc016871fb1af03f68d1135c9b9fe196c8c9c05236df7f3f305a1704149c8ba17d97ce470c
SSDEEP 24576:jFL23n5BfJXAENzLGXn8QMIFw2HQEUk5XjDPTKUYEm+ZmK7LMyLAExJj:F0BfJXAEhG38QM+7QEFTrvY6ZC4AEv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b8df4f501adfc1e0b5d108f123a79483.exe

Loads dropped DLL 3 IoCs

pid	Process
1340	rundll32.exe
1340	rundll32.exe
440	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4888	2440	b8df4f501adfc1e0b5d108f123a79483.exe	80
PID 2440 wrote to memory of 4888	2440	b8df4f501adfc1e0b5d108f123a79483.exe	80
PID 2440 wrote to memory of 4888	2440	b8df4f501adfc1e0b5d108f123a79483.exe	80
PID 4888 wrote to memory of 1340	4888	control.exe	81
PID 4888 wrote to memory of 1340	4888	control.exe	81
PID 4888 wrote to memory of 1340	4888	control.exe	81
PID 1340 wrote to memory of 1292	1340	rundll32.exe	88
PID 1340 wrote to memory of 1292	1340	rundll32.exe	88
PID 1292 wrote to memory of 440	1292	RunDll32.exe	89
PID 1292 wrote to memory of 440	1292	RunDll32.exe	89
PID 1292 wrote to memory of 440	1292	RunDll32.exe	89

C:\Users\Admin\AppData\Local\Temp\b8df4f501adfc1e0b5d108f123a79483.exe
"C:\Users\Admin\AppData\Local\Temp\b8df4f501adfc1e0b5d108f123a79483.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" .\NWWEM00Q.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\NWWEM00Q.8
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\NWWEM00Q.8
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\NWWEM00Q.8
        5⤵
        Loads dropped DLL
        
        PID:440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NWWEM00Q.8

Path C:\Users\Admin\AppData\Local\Temp\NWWEM00Q.8
Size 1.5MB
SHA256 ad7a7f6e33793f853fe77910d6be18f4bcd4754626fcd499c6c5cd48b603deae
MD5 9b26d054eddc3ba4d227e4ccb994327d
SHA1 5eabdaa4cfee87efa857e5dd5b317dd596cc4aef
SHA512 40497956bc561cf2c72fdf534dff4a383ff4d2fd418f5ebb01525a3960e22eb0578faebac1a84fa4c0e6de3bbbe15c378785178834f286f7fdfedbcb3a08b413
SSDEEP 24576:leMsrrCa2Q1JV0vliPrB2Rfe67ZnIwsKyof1pLYub5X5L4yFDnIej:Ytvu4roRfe8OShb55rnIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWWEm00Q.8

Path C:\Users\Admin\AppData\Local\Temp\nWWEm00Q.8
Size 1.5MB
SHA256 ad7a7f6e33793f853fe77910d6be18f4bcd4754626fcd499c6c5cd48b603deae
MD5 9b26d054eddc3ba4d227e4ccb994327d
SHA1 5eabdaa4cfee87efa857e5dd5b317dd596cc4aef
SHA512 40497956bc561cf2c72fdf534dff4a383ff4d2fd418f5ebb01525a3960e22eb0578faebac1a84fa4c0e6de3bbbe15c378785178834f286f7fdfedbcb3a08b413
SSDEEP 24576:leMsrrCa2Q1JV0vliPrB2Rfe67ZnIwsKyof1pLYub5X5L4yFDnIej:Ytvu4roRfe8OShb55rnIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWWEm00Q.8

Path C:\Users\Admin\AppData\Local\Temp\nWWEm00Q.8
Size 1.5MB
SHA256 ad7a7f6e33793f853fe77910d6be18f4bcd4754626fcd499c6c5cd48b603deae
MD5 9b26d054eddc3ba4d227e4ccb994327d
SHA1 5eabdaa4cfee87efa857e5dd5b317dd596cc4aef
SHA512 40497956bc561cf2c72fdf534dff4a383ff4d2fd418f5ebb01525a3960e22eb0578faebac1a84fa4c0e6de3bbbe15c378785178834f286f7fdfedbcb3a08b413
SSDEEP 24576:leMsrrCa2Q1JV0vliPrB2Rfe67ZnIwsKyof1pLYub5X5L4yFDnIej:Ytvu4roRfe8OShb55rnIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWWEm00Q.8

Path C:\Users\Admin\AppData\Local\Temp\nWWEm00Q.8
Size 1.5MB
SHA256 ad7a7f6e33793f853fe77910d6be18f4bcd4754626fcd499c6c5cd48b603deae
MD5 9b26d054eddc3ba4d227e4ccb994327d
SHA1 5eabdaa4cfee87efa857e5dd5b317dd596cc4aef
SHA512 40497956bc561cf2c72fdf534dff4a383ff4d2fd418f5ebb01525a3960e22eb0578faebac1a84fa4c0e6de3bbbe15c378785178834f286f7fdfedbcb3a08b413
SSDEEP 24576:leMsrrCa2Q1JV0vliPrB2Rfe67ZnIwsKyof1pLYub5X5L4yFDnIej:Ytvu4roRfe8OShb55rnIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-148-0x00000000032C0000-0x00000000033BB000-memory.dmp

Download

memory/440-153-0x00000000032C0000-0x00000000033BB000-memory.dmp

Download

memory/440-151-0x00000000034A0000-0x000000000355B000-memory.dmp

Download

memory/440-149-0x00000000033C0000-0x0000000003491000-memory.dmp

Download

memory/440-147-0x00000000030C0000-0x00000000031BD000-memory.dmp

Download

memory/1340-137-0x00000000023B0000-0x000000000252B000-memory.dmp

Download

memory/1340-142-0x0000000002B10000-0x0000000002BCB000-memory.dmp

Download

memory/1340-141-0x0000000002B10000-0x0000000002BCB000-memory.dmp

Download

memory/1340-140-0x0000000002A30000-0x0000000002B01000-memory.dmp

Download

memory/1340-139-0x0000000002930000-0x0000000002A2B000-memory.dmp

Download

memory/1340-138-0x0000000002730000-0x000000000282D000-memory.dmp

Download

memory/1340-154-0x0000000002930000-0x0000000002A2B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads