4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456

Analysis

max time kernel
91s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2022, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456.exe
Size

1.9MB
MD5

a49a1a62463ff3662ef7d7909a7e9cb0
SHA1

01c5fb6ea99d4b841266540c4a2b0ad6bd357243
SHA256

4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456
SHA512

fc1f3e265209cf8de3c82e8f1215fc8f8c15d5ccd566a72b82c7fd421cde41f84cc6349c7ac6c66223bee7d1614edaa4999ab5d5558eb5c8ead7ff4cc7b917fd
SSDEEP

49152:NsNMiYThVygeNyVcz9gJLkIuk05XqjL1JGSkO8KzZnaDIqq8NjAZ:uNVuhZNcpgJ1d05XG1kO8KkDIqq8JW

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456.exe

Loads dropped DLL 1 IoCs

pid	Process
4312	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 4312	376	4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456.exe	81
PID 376 wrote to memory of 4312	376	4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456.exe	81
PID 376 wrote to memory of 4312	376	4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456.exe	81

C:\Users\Admin\AppData\Local\Temp\4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456.exe
"C:\Users\Admin\AppData\Local\Temp\4b37197ce7042a7d7ae1ec7ab45cd94818a30b710ca1ecdb4dc9e9dca74dd456.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /U O5BYBS.KyV /s
  2⤵
  - Loads dropped DLL
  PID:4312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\O5BYBS.KyV

Filesize
2.0MB

MD5
4cc3091e2e92309cb970a3bbda268910

SHA1
213daf0f58fefca7a3ce619b78da52dce4ce0f42

SHA256
6f2b69860c8cac55247e6e85aae343402a07e39a6cd4be680a069f02fe1e46d6

SHA512
89b920327853f3d3772420ed838978dc6f90ea93cb340bdecce50326489673d6849d002e071a28ad0f047e62c0e383b27e6f6cf9ca85edd7720e68f6b64307db

Download Submit
C:\Users\Admin\AppData\Local\Temp\O5BYBS.kyV

Filesize
2.0MB

MD5
4cc3091e2e92309cb970a3bbda268910

SHA1
213daf0f58fefca7a3ce619b78da52dce4ce0f42

SHA256
6f2b69860c8cac55247e6e85aae343402a07e39a6cd4be680a069f02fe1e46d6

SHA512
89b920327853f3d3772420ed838978dc6f90ea93cb340bdecce50326489673d6849d002e071a28ad0f047e62c0e383b27e6f6cf9ca85edd7720e68f6b64307db

Download Submit
memory/4312-135-0x0000000002FC0000-0x00000000031C3000-memory.dmp

Filesize
2.0MB

Download
memory/4312-136-0x00000000737C0000-0x00000000739CE000-memory.dmp

Filesize
2.1MB

Download
memory/4312-137-0x0000000003830000-0x0000000003914000-memory.dmp

Filesize
912KB

Download
memory/4312-138-0x0000000003920000-0x00000000039EE000-memory.dmp

Filesize
824KB

Download