c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7

Analysis

max time kernel
82s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2023, 18:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7.exe
Size

1.4MB
MD5

1f4b4f96f13a3dd29b589fe3f94d9524
SHA1

37e4d469df87dc544e449c00bd663c6d3313d96e
SHA256

c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7
SHA512

cdfc7cc502ac236bd026f8b3667e94dac04146d5c9926817f42e4251cd67751e7c455369b574d04951aceb96e40f711a495333b34d7f691796967dc0a3ea0727
SSDEEP

24576:YLeTtjJFtHrKtaSAX0HMU8+1m7DpCCJYCnQ23TNTqzH3vurT2VwxerwRO9dM6Y:YLYkUSAX0sU8+1m7NCCJhQ23VcH3vwTn

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7.exe

Loads dropped DLL 2 IoCs

pid	Process
3448	regsvr32.exe
3448	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3448	4696	c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7.exe	80
PID 4696 wrote to memory of 3448	4696	c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7.exe	80
PID 4696 wrote to memory of 3448	4696	c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7.exe	80

C:\Users\Admin\AppData\Local\Temp\c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7.exe
"C:\Users\Admin\AppData\Local\Temp\c6f0a3221bde34e6a02e1a98201f4289b304a7aa899ca515b0b9971acaf952f7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s l9SECQMQ.Kl
  2⤵
  - Loads dropped DLL
  PID:3448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\l9SECQMQ.Kl

Filesize
1.5MB

MD5
c818f1e9d3ba1353372a200166cebf4b

SHA1
fa04cc22af0e7a3a6c598251be19811764a4e7e8

SHA256
0c0210065dd67be7ad3e02392956c716cf1cc778c274ce426589c43376080bda

SHA512
65273345d1382258acac14e005e869f23fa0e6821c258565292669b955624fb10fbf390e407d6bbf7f2952e3a7b512c49464c97da60c36ad8e817213d4a78d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\l9SEcQmq.Kl

Filesize
1.5MB

MD5
c818f1e9d3ba1353372a200166cebf4b

SHA1
fa04cc22af0e7a3a6c598251be19811764a4e7e8

SHA256
0c0210065dd67be7ad3e02392956c716cf1cc778c274ce426589c43376080bda

SHA512
65273345d1382258acac14e005e869f23fa0e6821c258565292669b955624fb10fbf390e407d6bbf7f2952e3a7b512c49464c97da60c36ad8e817213d4a78d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\l9SEcQmq.Kl

Filesize
1.5MB

MD5
c818f1e9d3ba1353372a200166cebf4b

SHA1
fa04cc22af0e7a3a6c598251be19811764a4e7e8

SHA256
0c0210065dd67be7ad3e02392956c716cf1cc778c274ce426589c43376080bda

SHA512
65273345d1382258acac14e005e869f23fa0e6821c258565292669b955624fb10fbf390e407d6bbf7f2952e3a7b512c49464c97da60c36ad8e817213d4a78d38

Download Submit
memory/3448-136-0x00000000022B0000-0x0000000002425000-memory.dmp

Filesize
1.5MB

Download
memory/3448-137-0x00000000022B0000-0x0000000002425000-memory.dmp

Filesize
1.5MB

Download
memory/3448-140-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/3448-141-0x0000000002670000-0x000000000275F000-memory.dmp

Filesize
956KB

Download
memory/3448-142-0x00000000021C0000-0x0000000002297000-memory.dmp

Filesize
860KB

Download
memory/3448-143-0x00000000021C0000-0x0000000002297000-memory.dmp

Filesize
860KB

Download