7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523

Analysis

max time kernel
90s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2022 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523.exe
Size

1.3MB
MD5

6df67448d286c098501ff0c8b4d9998f
SHA1

d51a48e8e9deb97d5d7dfbdf7f2158337ddf8949
SHA256

7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523
SHA512

1621975c1ace5fe05c583b786f8fd6706b3c48c65112f275d63eef1b4eb112e6a2a87813888881e9a991494a759dc49f48db5b6ae37d540e84f9540bb7c7f7d1
SSDEEP

24576:YLeTtjJFtHrKpXC+jgiZq9eIoBgVeTmrqOKVn2MgQY9zbOAi/vDaEUpVLbw:YLYk1g7vV4m2pVn2XzFbOACuEUpVL0

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523.exe

Loads dropped DLL 1 IoCs

pid	Process
3480	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 3480	796	7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523.exe	82
PID 796 wrote to memory of 3480	796	7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523.exe	82
PID 796 wrote to memory of 3480	796	7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523.exe	82

C:\Users\Admin\AppData\Local\Temp\7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523.exe
"C:\Users\Admin\AppData\Local\Temp\7bbb20b1e2a531e3c61eaf446f86a04b01f815377625d666eb5ea244323f3523.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s .\vUxL1r9.JN -u
  2⤵
  - Loads dropped DLL
  PID:3480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vUxL1r9.JN

Filesize
1.4MB

MD5
9751c162270df625af4a2869b1f5a91b

SHA1
3f9558f55f4426c346960af402fe710666217f4e

SHA256
e453b3a78595ce4f770c534fec9fd5d5b739c12a784a22f583ad42d457708da7

SHA512
f144e1429efee2968335ee5595451a4ea6a10b3095f1dd987031c58e337f4c0e5d37ea568761b7b4fc9eba253ee9774f236ba8f26d51fd6c3e6e90b53197e86e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vUxL1r9.jN

Filesize
1.4MB

MD5
9751c162270df625af4a2869b1f5a91b

SHA1
3f9558f55f4426c346960af402fe710666217f4e

SHA256
e453b3a78595ce4f770c534fec9fd5d5b739c12a784a22f583ad42d457708da7

SHA512
f144e1429efee2968335ee5595451a4ea6a10b3095f1dd987031c58e337f4c0e5d37ea568761b7b4fc9eba253ee9774f236ba8f26d51fd6c3e6e90b53197e86e

Download Submit
memory/3480-135-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/3480-138-0x0000000001070000-0x0000000001076000-memory.dmp

Filesize
24KB

Download
memory/3480-139-0x0000000002DE0000-0x0000000002EC1000-memory.dmp

Filesize
900KB

Download
memory/3480-140-0x0000000002BE0000-0x0000000002CAA000-memory.dmp

Filesize
808KB

Download