Analysis
-
max time kernel
77s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2023 04:30
Static task
static1
Behavioral task
behavioral1
Sample
ae6df34a140bf74860ca3165d50d8705.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ae6df34a140bf74860ca3165d50d8705.exe
Resource
win10v2004-20230220-en
General
-
Target
ae6df34a140bf74860ca3165d50d8705.exe
-
Size
308KB
-
MD5
ae6df34a140bf74860ca3165d50d8705
-
SHA1
ca21f7b3086341f2927f07d7005cce7cf4585c6b
-
SHA256
1d636ae88bab15613db7d92a33c0bd9d107270d68991faa01c6de1fa06364d92
-
SHA512
28080dc00054e209739bdbfb64704dae6bd5c82376606ae1fd61c4e0bfc502019e687ceb26b11a066b27f6b9c14dbce382ae3d1097954bc604a40c8ecd2117d6
-
SSDEEP
6144:bOsY+HgEiTA14Xn0Ti8v1bbFgXIQdjrfzNt1AEP3:i814Xn0Ti8tbJyIQdjrfzmEP3
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 4784 rundll32.exe 37 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation ae6df34a140bf74860ca3165d50d8705.exe -
Loads dropped DLL 1 IoCs
pid Process 2184 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2780 2184 WerFault.exe 90 -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1500 ae6df34a140bf74860ca3165d50d8705.exe 1500 ae6df34a140bf74860ca3165d50d8705.exe 2540 ae6df34a140bf74860ca3165d50d8705.exe 2540 ae6df34a140bf74860ca3165d50d8705.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2540 1500 ae6df34a140bf74860ca3165d50d8705.exe 87 PID 1500 wrote to memory of 2540 1500 ae6df34a140bf74860ca3165d50d8705.exe 87 PID 1500 wrote to memory of 2540 1500 ae6df34a140bf74860ca3165d50d8705.exe 87 PID 5080 wrote to memory of 2184 5080 rundll32.exe 90 PID 5080 wrote to memory of 2184 5080 rundll32.exe 90 PID 5080 wrote to memory of 2184 5080 rundll32.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae6df34a140bf74860ca3165d50d8705.exe"C:\Users\Admin\AppData\Local\Temp\ae6df34a140bf74860ca3165d50d8705.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\ae6df34a140bf74860ca3165d50d8705.exe"C:\Users\Admin\AppData\Local\Temp\ae6df34a140bf74860ca3165d50d8705.exe" -h2⤵
- Suspicious use of SetWindowsHookEx
PID:2540
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
PID:2184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 6043⤵
- Program crash
PID:2780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2184 -ip 21841⤵PID:4688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
557KB
MD5b15c9612f747a2c7d6c429275c853b23
SHA146b5013dcc6677feabafb3c35d8aec6e79e1e6d3
SHA25607b7dbc6e80247cee12695bc386079435ec90d0228f799ff884330b9f4e3c2d5
SHA5122f70c8c18434e7a7e1475acda04ba2d3e13fd20c73ee14ff28eda50394898333e8c7067bea69cca28cff1226cdf050db55df2bcd629fb82b9f0535a505d07305
-
Filesize
52KB
MD51b20e998d058e813dfc515867d31124f
SHA1c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA25624a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA51279849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6
-
Filesize
52KB
MD51b20e998d058e813dfc515867d31124f
SHA1c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA25624a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA51279849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6