062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe
Size

1.3MB
MD5

02d5eec60b7fb7f8d85e37b488d46394
SHA1

15863a70fe75aefe4a88b716650be54df1774bb4
SHA256

062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee
SHA512

fc8a673a4512b59ddc56896bf5b41ace48e119ccf99d520a240a2186ef149746f1f834fe9ad5c97f5cd18f99591d46ad9b5d757d64b7075af5ecc5ad3450e7ef
SSDEEP

24576:hZ7Xar2VsBq/Oebth566XG/EMll5LuaBSiESch1ZPodsXFuYUOyLVwJ57:NsY5662B5qCEScD5odPtVwP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

2840 regsvr32.exe
2840 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2840	regsvr32.exe
2840	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe

description	pid	process	target process
PID 2420 wrote to memory of 2840	2420	062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe	regsvr32.exe
PID 2420 wrote to memory of 2840	2420	062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe	regsvr32.exe
PID 2420 wrote to memory of 2840	2420	062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe
"C:\Users\Admin\AppData\Local\Temp\062af7b87c8caa91054242822b095f01208a6981eea1f404a18c6e842f7164ee.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /U f_CGBpRr.t -S
2⤵
- Loads dropped DLL
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f_CGBpRr.t
Filesize
1.4MB

MD5
a2a8eefb9bc71f65f77049bb740413c0

SHA1
e7be7c53a49d6b7cc0d4165ff84663467224c02c

SHA256
263cbda48d5f370b73539f619cb9ca08f47e6c1f6b9259a52094df9f93f85a65

SHA512
56b0bab29f1beca5ca12113dcc22248397aa20ffc6cb428815142201e6af6801bb686e5537b9f7a152e8fa7c53ae1d34a5a564cd10eb9bd61a994d55d9471b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\f_cGbprr.t
Filesize
1.4MB

MD5
a2a8eefb9bc71f65f77049bb740413c0

SHA1
e7be7c53a49d6b7cc0d4165ff84663467224c02c

SHA256
263cbda48d5f370b73539f619cb9ca08f47e6c1f6b9259a52094df9f93f85a65

SHA512
56b0bab29f1beca5ca12113dcc22248397aa20ffc6cb428815142201e6af6801bb686e5537b9f7a152e8fa7c53ae1d34a5a564cd10eb9bd61a994d55d9471b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\f_cGbprr.t
Filesize
1.4MB

MD5
a2a8eefb9bc71f65f77049bb740413c0

SHA1
e7be7c53a49d6b7cc0d4165ff84663467224c02c

SHA256
263cbda48d5f370b73539f619cb9ca08f47e6c1f6b9259a52094df9f93f85a65

SHA512
56b0bab29f1beca5ca12113dcc22248397aa20ffc6cb428815142201e6af6801bb686e5537b9f7a152e8fa7c53ae1d34a5a564cd10eb9bd61a994d55d9471b45

Download Submit
memory/2840-132-0x0000000000000000-mapping.dmp

Download
memory/2840-136-0x00000000023C0000-0x0000000002525000-memory.dmp

Filesize
1.4MB

Download
memory/2840-137-0x00000000023C0000-0x0000000002525000-memory.dmp

Filesize
1.4MB

Download
memory/2840-140-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/2840-141-0x0000000002640000-0x0000000002727000-memory.dmp

Filesize
924KB

Download
memory/2840-142-0x0000000002730000-0x0000000002800000-memory.dmp

Filesize
832KB

Download
memory/2840-143-0x0000000002730000-0x0000000002800000-memory.dmp

Filesize
832KB

Download