bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42.exe
Size

1.3MB
MD5

3271dc4cb8d92f14569534a58ff5274c
SHA1

dd8f0d87a8109af4d325c8d81e086aec453614f8
SHA256

bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42
SHA512

15ab6d723f770e0e902fc946b2f3ce90cc0efcc56500b6ab3c476df506c27e82ec219165386f991c6917a880e7baf60be8e997aec58c1c0eb16f21d52a5a43ef
SSDEEP

24576:WBqaS/LEMUXH30nUoeErbttNX/9GKvRXVh5dNs0whaC1GJ:WBqaaQH35ArLNIKvRXD58MCIJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42.exe

Loads dropped DLL 2 IoCs

pid	Process
3876	regsvr32.exe
3876	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3876	628	bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42.exe	80
PID 628 wrote to memory of 3876	628	bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42.exe	80
PID 628 wrote to memory of 3876	628	bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42.exe	80

C:\Users\Admin\AppData\Local\Temp\bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42.exe
"C:\Users\Admin\AppData\Local\Temp\bcf7dcc0a5ebc213c5ba590f64c91c3a7b9d287276d066dd2b4530970d195b42.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /U 3SP4sGj.JM -s
  2⤵
  - Loads dropped DLL
  PID:3876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3SP4sGj.JM

Filesize
1.4MB

MD5
5720f934dd33433443f9961cdacb3a2e

SHA1
1e3dfc053957a00cd86b295fec338fdb14312527

SHA256
32d0f5b74ca75368756b92c8329a68de67d5f73a9d42ceec433876bb5d2c5ea9

SHA512
cac318e753078383210ca9fc8eabdc34234e49f190fb055aada9a3ac60b8adc204afcf4ca3d7d73071b67f776afd3f7a9110dafe9319ac3e15c229d14fd23888

Download Submit
C:\Users\Admin\AppData\Local\Temp\3SP4sgj.jM

Filesize
1.4MB

MD5
5720f934dd33433443f9961cdacb3a2e

SHA1
1e3dfc053957a00cd86b295fec338fdb14312527

SHA256
32d0f5b74ca75368756b92c8329a68de67d5f73a9d42ceec433876bb5d2c5ea9

SHA512
cac318e753078383210ca9fc8eabdc34234e49f190fb055aada9a3ac60b8adc204afcf4ca3d7d73071b67f776afd3f7a9110dafe9319ac3e15c229d14fd23888

Download Submit
C:\Users\Admin\AppData\Local\Temp\3SP4sgj.jM

Filesize
1.4MB

MD5
5720f934dd33433443f9961cdacb3a2e

SHA1
1e3dfc053957a00cd86b295fec338fdb14312527

SHA256
32d0f5b74ca75368756b92c8329a68de67d5f73a9d42ceec433876bb5d2c5ea9

SHA512
cac318e753078383210ca9fc8eabdc34234e49f190fb055aada9a3ac60b8adc204afcf4ca3d7d73071b67f776afd3f7a9110dafe9319ac3e15c229d14fd23888

Download Submit
memory/3876-136-0x0000000000AB0000-0x0000000000C24000-memory.dmp

Filesize
1.5MB

Download
memory/3876-137-0x0000000000AB0000-0x0000000000C24000-memory.dmp

Filesize
1.5MB

Download
memory/3876-140-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3876-141-0x00000000022D0000-0x00000000023B5000-memory.dmp

Filesize
916KB

Download
memory/3876-142-0x00000000023C0000-0x000000000248F000-memory.dmp

Filesize
828KB

Download
memory/3876-143-0x00000000023C0000-0x000000000248F000-memory.dmp

Filesize
828KB

Download