Analysis
-
max time kernel
141s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2023 12:37
Static task
static1
Behavioral task
behavioral1
Sample
e7f609df5c0fcdc581a69ed69aa3c4a1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e7f609df5c0fcdc581a69ed69aa3c4a1.exe
Resource
win10v2004-20230220-en
General
-
Target
e7f609df5c0fcdc581a69ed69aa3c4a1.exe
-
Size
308KB
-
MD5
e7f609df5c0fcdc581a69ed69aa3c4a1
-
SHA1
345ac5a24438b8edb695d32bde79502023e09e31
-
SHA256
54151922b3a7a1f16e1b10356da10b8293b6ca897fed9d48ffeb3d2eae2685cd
-
SHA512
76772a9020ad88203d54ed5d792929957145057da17eff9f6b07c292fd76c0aa120b3ea8ab23c6f7a5c9a802422adf906294ace90a53d90eeafb86a92bae008c
-
SSDEEP
6144:bOsY+HgEiTA14Xn0Ti8v1bbFgXIQdjrfzNt1IEP3:i814Xn0Ti8tbJyIQdjrfzuEP3
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 888 4236 rundll32.exe 72 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation e7f609df5c0fcdc581a69ed69aa3c4a1.exe -
Loads dropped DLL 1 IoCs
pid Process 3728 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2064 3728 WerFault.exe 88 -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3396 e7f609df5c0fcdc581a69ed69aa3c4a1.exe 3396 e7f609df5c0fcdc581a69ed69aa3c4a1.exe 1924 e7f609df5c0fcdc581a69ed69aa3c4a1.exe 1924 e7f609df5c0fcdc581a69ed69aa3c4a1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3396 wrote to memory of 1924 3396 e7f609df5c0fcdc581a69ed69aa3c4a1.exe 86 PID 3396 wrote to memory of 1924 3396 e7f609df5c0fcdc581a69ed69aa3c4a1.exe 86 PID 3396 wrote to memory of 1924 3396 e7f609df5c0fcdc581a69ed69aa3c4a1.exe 86 PID 888 wrote to memory of 3728 888 rundll32.exe 88 PID 888 wrote to memory of 3728 888 rundll32.exe 88 PID 888 wrote to memory of 3728 888 rundll32.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7f609df5c0fcdc581a69ed69aa3c4a1.exe"C:\Users\Admin\AppData\Local\Temp\e7f609df5c0fcdc581a69ed69aa3c4a1.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\e7f609df5c0fcdc581a69ed69aa3c4a1.exe"C:\Users\Admin\AppData\Local\Temp\e7f609df5c0fcdc581a69ed69aa3c4a1.exe" -h2⤵
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
PID:3728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 6003⤵
- Program crash
PID:2064
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3728 -ip 37281⤵PID:1852
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
557KB
MD51bd81dc243577b6a0c7f93f6bd9ae40b
SHA19d4e908b53e52c5216ea7746d2e1b33abea9bc1c
SHA2563b667512e2dc899bc4e0d92628a981b4487b9423c6ae3804893a30c67a2de21c
SHA512e7e647733b88c78b8bb6c1951780b2627e2b0b66dc2b29d257f2925d837936bd12eaa56b43c7d59ec663e81fa31ec50f4767de8ab1441c645c0890aec79a8d10
-
Filesize
52KB
MD51b20e998d058e813dfc515867d31124f
SHA1c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA25624a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA51279849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6
-
Filesize
52KB
MD51b20e998d058e813dfc515867d31124f
SHA1c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA25624a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA51279849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6