Behavioral Report

Analysis

max time kernel
106s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:51

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe
Size

1MB
MD5

db77cacff97989bb1c1d64ddcad046da
SHA1

7c38eff8b0175f0cfef7a31112222ed0e3c144b1
SHA256

cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145
SHA512

38de264a721bc7a00b0914bb4ce41b5969092e5398630e9c7bca4a7a91e841405b91e05f7aff442b9647c35f77fc6e8b8b001c0b3053d647bb9ea2d87d52a221
SSDEEP

24576:UDWHSb4N70rKKUsu0Wl53iW9T5z/WOcQ2cZFFIuLI38SYI4O2wW0B:v84U8V/JcQDPL46I4ODtB

Score

7^/10

Malware Config

Signatures

Checks computer location settings ⋅ 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

TTPs:

Query Registry System Information Discovery

Processes:

cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe

Loads dropped DLL ⋅ 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

4240 rundll32.exe
3656 rundll32.exe
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery

pid	process
4240	rundll32.exe
3656	rundll32.exe

Suspicious use of WriteProcessMemory ⋅ 11 IoCs

Processes:

cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.execontrol.exerundll32.exeRunDll32.exe

description	pid	process	target process
PID 4248 wrote to memory of 4268	4248	cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe	control.exe
PID 4248 wrote to memory of 4268	4248	cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe	control.exe
PID 4248 wrote to memory of 4268	4248	cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe	control.exe
PID 4268 wrote to memory of 4240	4268	control.exe	rundll32.exe
PID 4268 wrote to memory of 4240	4268	control.exe	rundll32.exe
PID 4268 wrote to memory of 4240	4268	control.exe	rundll32.exe
PID 4240 wrote to memory of 3756	4240	rundll32.exe	RunDll32.exe
PID 4240 wrote to memory of 3756	4240	rundll32.exe	RunDll32.exe
PID 3756 wrote to memory of 3656	3756	RunDll32.exe	rundll32.exe
PID 3756 wrote to memory of 3656	3756	RunDll32.exe	rundll32.exe
PID 3756 wrote to memory of 3656	3756	RunDll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe

"C:\Users\Admin\AppData\Local\Temp\cded11cb2f89ab0caafaa53d02cdd39682aab2fa82011565a5a5857fdf9bb145.exe"

Checks computer location settings
Suspicious use of WriteProcessMemory

PID:4248

C:\Windows\SysWOW64\control.exe

"C:\Windows\System32\control.exe" .\U_U5.B1

Suspicious use of WriteProcessMemory

PID:4268

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\U_U5.B1

Loads dropped DLL
Suspicious use of WriteProcessMemory

PID:4240

C:\Windows\system32\RunDll32.exe

C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\U_U5.B1

Suspicious use of WriteProcessMemory

PID:3756

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\U_U5.B1

Loads dropped DLL

PID:3656

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Temp\U_U5.B1
Filesize
1MB

MD5
cc1e2e03ad0761d2f95842b6d20854ad

SHA1
7d9aed0eee2cb5fbec7b6a4bfc064e22d855d2cf

SHA256
042f8e826dc5956f74d1b35c0b7cd4c0a11ae417077af4cd8c55e030cbce288a

SHA512
3f9ee45e284450572906c6e835a54dbcf341329c2852e6e476d408b6fbb49c7f59aa9ed746803f195df058548becb1a311940614f351fbeddd6a175228643d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\u_u5.b1
Filesize
1MB

MD5
cc1e2e03ad0761d2f95842b6d20854ad

SHA1
7d9aed0eee2cb5fbec7b6a4bfc064e22d855d2cf

SHA256
042f8e826dc5956f74d1b35c0b7cd4c0a11ae417077af4cd8c55e030cbce288a

SHA512
3f9ee45e284450572906c6e835a54dbcf341329c2852e6e476d408b6fbb49c7f59aa9ed746803f195df058548becb1a311940614f351fbeddd6a175228643d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\u_u5.b1
Filesize
1MB

MD5
cc1e2e03ad0761d2f95842b6d20854ad

SHA1
7d9aed0eee2cb5fbec7b6a4bfc064e22d855d2cf

SHA256
042f8e826dc5956f74d1b35c0b7cd4c0a11ae417077af4cd8c55e030cbce288a

SHA512
3f9ee45e284450572906c6e835a54dbcf341329c2852e6e476d408b6fbb49c7f59aa9ed746803f195df058548becb1a311940614f351fbeddd6a175228643d10

Download Submit
memory/3656-145-0x0000000000000000-mapping.dmp

Download
memory/3656-153-0x0000000002BD0000-0x0000000002CA0000-memory.dmp

Filesize
832KB

Download
memory/3656-151-0x0000000002AE0000-0x0000000002BC7000-memory.dmp

Filesize
924KB

Download
memory/3656-150-0x0000000000B70000-0x0000000000B76000-memory.dmp

Filesize
24KB

Download
memory/3756-144-0x0000000000000000-mapping.dmp

Download
memory/4240-142-0x0000000002F20000-0x0000000002FF0000-memory.dmp

Filesize
832KB

Download
memory/4240-141-0x0000000002F20000-0x0000000002FF0000-memory.dmp

Filesize
832KB

Download
memory/4240-140-0x0000000002E30000-0x0000000002F17000-memory.dmp

Filesize
924KB

Download
memory/4240-139-0x00000000028A0000-0x00000000028A6000-memory.dmp

Filesize
24KB

Download
memory/4240-136-0x0000000000400000-0x0000000000565000-memory.dmp

Filesize
1MB

Download
memory/4240-133-0x0000000000000000-mapping.dmp

Download
memory/4268-132-0x0000000000000000-mapping.dmp

Download