be15602eb67ae71bba0dd98c4bca1e9e3afccbf6cc1eb90bed6dda268253be69

Analysis

max time kernel
65s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2023, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c946978783129685732cbac93cc633e.exe
Size 1.3MB
Sample230218-kpvvmsbf48
SHA256 be15602eb67ae71bba0dd98c4bca1e9e3afccbf6cc1eb90bed6dda268253be69
MD5 3c946978783129685732cbac93cc633e
SHA1 95ba3d42a0974bea920967d440151b313b764aae
SHA512 a2259458bec1feafc433b893cac4678212b0d80c8003f7bdb2b117c5b36b1c0068758081e766f8f02316d5bd331ae1f6e4f84a3d71855b4d1ba18a37efc2e934
SSDEEP 24576:VLeTtjJF5HrKPDxICb0yTRZe2xYjQyaSWrXxD0Lj3teRcULiM22n4u3:VLYgPmCIYZe7jQAWrhQrIWKg2nF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	3c946978783129685732cbac93cc633e.exe

Loads dropped DLL 2 IoCs

pid	Process
1324	rundll32.exe
4404	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	3c946978783129685732cbac93cc633e.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4960	4056	3c946978783129685732cbac93cc633e.exe	81
PID 4056 wrote to memory of 4960	4056	3c946978783129685732cbac93cc633e.exe	81
PID 4056 wrote to memory of 4960	4056	3c946978783129685732cbac93cc633e.exe	81
PID 4960 wrote to memory of 1324	4960	control.exe	83
PID 4960 wrote to memory of 1324	4960	control.exe	83
PID 4960 wrote to memory of 1324	4960	control.exe	83
PID 1324 wrote to memory of 4088	1324	rundll32.exe	84
PID 1324 wrote to memory of 4088	1324	rundll32.exe	84
PID 4088 wrote to memory of 4404	4088	RunDll32.exe	85
PID 4088 wrote to memory of 4404	4088	RunDll32.exe	85
PID 4088 wrote to memory of 4404	4088	RunDll32.exe	85

C:\Users\Admin\AppData\Local\Temp\3c946978783129685732cbac93cc633e.exe
"C:\Users\Admin\AppData\Local\Temp\3c946978783129685732cbac93cc633e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\DNNE~4.Cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\DNNE~4.Cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\DNNE~4.Cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\DNNE~4.Cpl",
        5⤵
        Loads dropped DLL
        
        PID:4404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DNNE~4.Cpl

Path C:\Users\Admin\AppData\Local\Temp\DNNE~4.Cpl
Size 1.3MB
SHA256 427a9240c7c411d3f29ea085952c8e3262d6e679f6a6bd3958838f5f0ac6cb26
MD5 b97d44be6b0b63f235f8f9f0e1018128
SHA1 735f3093d75fad21a595f56706ab91df254fe326
SHA512 79d8b4732b2cc8a4d4742a3e2214357ec6b8baf94031f5f995e264208d61d63d4995339521394f78d210c4376eb4541f3df5ce7d4e9f1ab7aef95faf82b56923
SSDEEP 24576:H3rICB0yBRHU2Jk8jYO0cmv3pD0hjTt8RcGLig22n:HsC6+HUkk8jYcmvZ4P6WMG2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

DNNE~4.cpl

Path C:\Users\Admin\AppData\Local\Temp\DNNE~4.cpl
Size 1.3MB
SHA256 427a9240c7c411d3f29ea085952c8e3262d6e679f6a6bd3958838f5f0ac6cb26
MD5 b97d44be6b0b63f235f8f9f0e1018128
SHA1 735f3093d75fad21a595f56706ab91df254fe326
SHA512 79d8b4732b2cc8a4d4742a3e2214357ec6b8baf94031f5f995e264208d61d63d4995339521394f78d210c4376eb4541f3df5ce7d4e9f1ab7aef95faf82b56923
SSDEEP 24576:H3rICB0yBRHU2Jk8jYO0cmv3pD0hjTt8RcGLig22n:HsC6+HUkk8jYcmvZ4P6WMG2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

DNNE~4.cpl

Path C:\Users\Admin\AppData\Local\Temp\DNNE~4.cpl
Size 1.3MB
SHA256 427a9240c7c411d3f29ea085952c8e3262d6e679f6a6bd3958838f5f0ac6cb26
MD5 b97d44be6b0b63f235f8f9f0e1018128
SHA1 735f3093d75fad21a595f56706ab91df254fe326
SHA512 79d8b4732b2cc8a4d4742a3e2214357ec6b8baf94031f5f995e264208d61d63d4995339521394f78d210c4376eb4541f3df5ce7d4e9f1ab7aef95faf82b56923
SSDEEP 24576:H3rICB0yBRHU2Jk8jYO0cmv3pD0hjTt8RcGLig22n:HsC6+HUkk8jYcmvZ4P6WMG2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1324-140-0x0000000003390000-0x0000000003484000-memory.dmp

Download

memory/1324-136-0x0000000000400000-0x0000000000556000-memory.dmp

Download

memory/1324-139-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

Download

memory/1324-141-0x0000000003490000-0x000000000356B000-memory.dmp

Download

memory/4404-150-0x0000000002D20000-0x0000000002D26000-memory.dmp

Download

memory/4404-151-0x0000000002FB0000-0x00000000030A4000-memory.dmp

Download

memory/4404-152-0x00000000030B0000-0x000000000318B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads