c82ab145610c19c3f5a1462196b41347c9786f5e600bdaa477bb98814461d279

Resubmissions

06/01/2023, 04:36

230106-e8dgtaec4610

06/01/2023, 04:17

230106-ewqxdaeb9710

Analysis

max time kernel
506s
max time network
508s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wj.exe
Size 131KB
Sample230106-e8dgtaec46
SHA256 c82ab145610c19c3f5a1462196b41347c9786f5e600bdaa477bb98814461d279
MD5 c139e5739b99c5a835aaf6642b7a4378
SHA1 4ef2c73cd79984bd634adddbeef4dd091394ff46
SHA512 2fdfcc9534a8045976a795373557ad60548c36ea3c54e334e4a337100e3a879f802989b2dcac6565688f466d5fbde8e4e1e5e7d1b54151aacd2408329140f799
SSDEEP 3072:wLDfdYjOWlRjd+J3lIV4g4SAacOWJPMbwbNddf7wHx7hzlP:wvdkOhfPMcDN7I7tlP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	1516	rundll32.exe	21

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wj.exe

Loads dropped DLL 1 IoCs

pid	Process
996	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4108	996	WerFault.exe	84

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 2200	3836	wj.exe	81
PID 3836 wrote to memory of 2200	3836	wj.exe	81
PID 3836 wrote to memory of 2200	3836	wj.exe	81
PID 4832 wrote to memory of 996	4832	rundll32.exe	84
PID 4832 wrote to memory of 996	4832	rundll32.exe	84
PID 4832 wrote to memory of 996	4832	rundll32.exe	84

C:\Users\Admin\AppData\Local\Temp\wj.exe
"C:\Users\Admin\AppData\Local\Temp\wj.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\wj.exe
  "C:\Users\Admin\AppData\Local\Temp\wj.exe" -h
  2⤵
  PID:2200

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 600
    3⤵
    - Program crash
    PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 996 -ip 996
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 557KB
SHA256 b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628
MD5 30d5f615722d12fdda4f378048221909
SHA1 e94e3e3a6fae8b29f0f80128761ad1b69304a7eb
SHA512 a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2
SSDEEP 12288:FV1e0UgkVT6ZT+3JCnoxgLgoCXwbePLJrH8fwpL:FV1edgkV8T0CnoxZ4ePLJTMwpL
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
MD5 0b35335b70b96d31633d0caa207d71f9
SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
MD5 0b35335b70b96d31633d0caa207d71f9
SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads