66160a21075a9a4ff9c3e8f338da2ba4530b13f0442b5bb7b008586d4a669f20

Analysis

max time kernel
78s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2023, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53d775f775b2142e79c7de341f0c0176.exe
Size 1.7MB
Sample230302-wlbhdaeb25
SHA256 66160a21075a9a4ff9c3e8f338da2ba4530b13f0442b5bb7b008586d4a669f20
MD5 53d775f775b2142e79c7de341f0c0176
SHA1 bda9efd38c7896bed2bb9e56314a38a7a9edb872
SHA512 40af7270cbc284cf190d22fdf67c6603a8b4b6648cd9eec216d02d4c1ae230e4690c245437296c9c4d33ae41c92603e018489517510ae266046041ddb3c2dd43
SSDEEP 49152:EuWx3w+NhDfUncQaZx+7/4f4lOzs21CmhtuMXPPEng0Qp9:EuWe+EncQaZY0fIOQmnPEg0Qp9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	53d775f775b2142e79c7de341f0c0176.exe

Loads dropped DLL 2 IoCs

pid	Process
2976	rundll32.exe
4468	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	53d775f775b2142e79c7de341f0c0176.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 2296	4872	53d775f775b2142e79c7de341f0c0176.exe	86
PID 4872 wrote to memory of 2296	4872	53d775f775b2142e79c7de341f0c0176.exe	86
PID 4872 wrote to memory of 2296	4872	53d775f775b2142e79c7de341f0c0176.exe	86
PID 2296 wrote to memory of 2976	2296	control.exe	88
PID 2296 wrote to memory of 2976	2296	control.exe	88
PID 2296 wrote to memory of 2976	2296	control.exe	88
PID 2976 wrote to memory of 3852	2976	rundll32.exe	92
PID 2976 wrote to memory of 3852	2976	rundll32.exe	92
PID 3852 wrote to memory of 4468	3852	RunDll32.exe	93
PID 3852 wrote to memory of 4468	3852	RunDll32.exe	93
PID 3852 wrote to memory of 4468	3852	RunDll32.exe	93

C:\Users\Admin\AppData\Local\Temp\53d775f775b2142e79c7de341f0c0176.exe
"C:\Users\Admin\AppData\Local\Temp\53d775f775b2142e79c7de341f0c0176.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\8IJp.CPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8IJp.CPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8IJp.CPL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3852
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\8IJp.CPL",
        5⤵
        Loads dropped DLL
        
        PID:4468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8IJp.CPL

Path C:\Users\Admin\AppData\Local\Temp\8IJp.CPL
Size 1.4MB
SHA256 d8a74007feb66b4341a6813f272bfbbabc43d813b395fe25150919e9ac9d1a92
MD5 8bc9078c303156e113ad8b1a85cab203
SHA1 3a661069b13e3ddd91c8911a13b83d430b0d6799
SHA512 c9c4f9c61bfd9184e810146e1ce870062010635bc91c6d691e9cba949b561983e81e628e77bbb2b350d0d72f37c3c2059dead97cb5c9eb343a8658f304ff05d3
SSDEEP 24576:DoUVZI/nN3zocUvFZvaIHGxeMScyUZupNk6mbUDMRcl/Bm:DoUI/nN30ZvFZCB9Sug32bKBm
MD5 SHA1 SHA512 SSDEEP

Submit Download

8IJp.cpl

Path C:\Users\Admin\AppData\Local\Temp\8IJp.cpl
Size 1.4MB
SHA256 d8a74007feb66b4341a6813f272bfbbabc43d813b395fe25150919e9ac9d1a92
MD5 8bc9078c303156e113ad8b1a85cab203
SHA1 3a661069b13e3ddd91c8911a13b83d430b0d6799
SHA512 c9c4f9c61bfd9184e810146e1ce870062010635bc91c6d691e9cba949b561983e81e628e77bbb2b350d0d72f37c3c2059dead97cb5c9eb343a8658f304ff05d3
SSDEEP 24576:DoUVZI/nN3zocUvFZvaIHGxeMScyUZupNk6mbUDMRcl/Bm:DoUI/nN30ZvFZCB9Sug32bKBm
MD5 SHA1 SHA512 SSDEEP

Submit Download

8IJp.cpl

Path C:\Users\Admin\AppData\Local\Temp\8IJp.cpl
Size 1.4MB
SHA256 d8a74007feb66b4341a6813f272bfbbabc43d813b395fe25150919e9ac9d1a92
MD5 8bc9078c303156e113ad8b1a85cab203
SHA1 3a661069b13e3ddd91c8911a13b83d430b0d6799
SHA512 c9c4f9c61bfd9184e810146e1ce870062010635bc91c6d691e9cba949b561983e81e628e77bbb2b350d0d72f37c3c2059dead97cb5c9eb343a8658f304ff05d3
SSDEEP 24576:DoUVZI/nN3zocUvFZvaIHGxeMScyUZupNk6mbUDMRcl/Bm:DoUI/nN30ZvFZCB9Sug32bKBm
MD5 SHA1 SHA512 SSDEEP

Submit Download

8IJp.cpl

Path C:\Users\Admin\AppData\Local\Temp\8IJp.cpl
Size 1.4MB
SHA256 d8a74007feb66b4341a6813f272bfbbabc43d813b395fe25150919e9ac9d1a92
MD5 8bc9078c303156e113ad8b1a85cab203
SHA1 3a661069b13e3ddd91c8911a13b83d430b0d6799
SHA512 c9c4f9c61bfd9184e810146e1ce870062010635bc91c6d691e9cba949b561983e81e628e77bbb2b350d0d72f37c3c2059dead97cb5c9eb343a8658f304ff05d3
SSDEEP 24576:DoUVZI/nN3zocUvFZvaIHGxeMScyUZupNk6mbUDMRcl/Bm:DoUI/nN30ZvFZCB9Sug32bKBm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2976-144-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/2976-147-0x0000000002F60000-0x000000000306A000-memory.dmp

Download

memory/2976-148-0x0000000003070000-0x0000000003160000-memory.dmp

Download

memory/2976-151-0x0000000003070000-0x0000000003160000-memory.dmp

Download

memory/2976-152-0x0000000003070000-0x0000000003160000-memory.dmp

Download

memory/2976-146-0x00000000010A0000-0x00000000010A6000-memory.dmp

Download

memory/4468-156-0x0000000000FB0000-0x0000000000FB6000-memory.dmp

Download

memory/4468-157-0x0000000002DA0000-0x0000000002EAA000-memory.dmp

Download

memory/4468-158-0x0000000002EB0000-0x0000000002FA0000-memory.dmp

Download

memory/4468-161-0x0000000002EB0000-0x0000000002FA0000-memory.dmp

Download

memory/4468-162-0x0000000002EB0000-0x0000000002FA0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads