9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e

Analysis

max time kernel
111s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2023, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe
Size

312KB
MD5

a63057366b53fe3c59b9491bdf73587c
SHA1

45ddabd33f3f1f3ca48497d059bb78aa0cb2f69e
SHA256

9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e
SHA512

a51461ce3c278cbeef32486fa06793e52f2a718cd9ccc27af553068b66cb2763965a3f59e9f168af32702c5c6037610160f66542892933eee199554e7e8cfdd9
SSDEEP

6144:IviyYPpr8AE0W0H2Xe1L8AAXb25160uYR+kkEPD:Ivh0W0WX8L8TXO60uYRGEPD

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	4188	rundll32.exe	23

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe

Loads dropped DLL 1 IoCs

pid	Process
4232	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	4232	WerFault.exe	84

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4644	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe
4644	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe
4532	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe
4532	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4532	4644	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe	82
PID 4644 wrote to memory of 4532	4644	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe	82
PID 4644 wrote to memory of 4532	4644	9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe	82
PID 5000 wrote to memory of 4232	5000	rundll32.exe	84
PID 5000 wrote to memory of 4232	5000	rundll32.exe	84
PID 5000 wrote to memory of 4232	5000	rundll32.exe	84

C:\Users\Admin\AppData\Local\Temp\9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe
"C:\Users\Admin\AppData\Local\Temp\9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe
  "C:\Users\Admin\AppData\Local\Temp\9b5cffd1061d2c40b427637d069cde28b639dbebb23a357567168c8806d4038e.exe" -h
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4532

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:4232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 600
    3⤵
    - Program crash
    PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4232 -ip 4232
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\db.dat

Filesize
557KB

MD5
535677ceb05cbea48bc25b52a5c2da67

SHA1
52906724f2135086417fffb42a60cf6f0d55362d

SHA256
c685c604b16270bb5417594aa58f7c532e617d21f61ffe683a03c387dbbddefc

SHA512
c812b3612a00afffce17613629b72a6ac43a10f7ca69376c5e3dc87d1f60e6c38432ec73de74279c6e32ca20a47e8bbd23ef06fb7be50d46494701f1bcdcfb3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit