ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043

General

Target

ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe
Size

1.5MB
MD5

9f9e211936405eb8a82f1d5994410fe3
SHA1

0d89d49e105f0f5969e5130ee548a4c1b8f5371d
SHA256

ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043
SHA512

8bb77ac69203392b9282756f9f5b143207775fed3450a19758b505076eb3837a515473d2372fa28991a5a79317ee8a8af70e95abd907d746cec4e3b86fb7400e
SSDEEP

24576:gJr8tE+gHqYxcvENb94f5m2j1GkY5YNeGTsU11OF9KFHihG6A5aJns7YZdOhIUZ2:gJ4NYxl/4ImgdJGAs9H950ns7YZAhIE2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe

Loads dropped DLL 2 IoCs

pid	Process
4596	rundll32.exe
3384	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 656	1764	ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe	86
PID 1764 wrote to memory of 656	1764	ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe	86
PID 1764 wrote to memory of 656	1764	ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe	86
PID 656 wrote to memory of 4596	656	control.exe	88
PID 656 wrote to memory of 4596	656	control.exe	88
PID 656 wrote to memory of 4596	656	control.exe	88
PID 4596 wrote to memory of 2436	4596	rundll32.exe	89
PID 4596 wrote to memory of 2436	4596	rundll32.exe	89
PID 2436 wrote to memory of 3384	2436	RunDll32.exe	90
PID 2436 wrote to memory of 3384	2436	RunDll32.exe	90
PID 2436 wrote to memory of 3384	2436	RunDll32.exe	90

C:\Users\Admin\AppData\Local\Temp\ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe
"C:\Users\Admin\AppData\Local\Temp\ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",
        5⤵
        Loads dropped DLL
        
        PID:3384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8~2F.cpL

Filesize
1.2MB

MD5
82be888c141ae14ffaea211c6ae4fbea

SHA1
dd258160c64d05a7ca9f9dd74580ed9663fde41b

SHA256
5de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54

SHA512
728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8~2F.cpl

Filesize
1.2MB

MD5
82be888c141ae14ffaea211c6ae4fbea

SHA1
dd258160c64d05a7ca9f9dd74580ed9663fde41b

SHA256
5de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54

SHA512
728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8~2F.cpl

Filesize
1.2MB

MD5
82be888c141ae14ffaea211c6ae4fbea

SHA1
dd258160c64d05a7ca9f9dd74580ed9663fde41b

SHA256
5de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54

SHA512
728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8~2F.cpl

Filesize
1.2MB

MD5
82be888c141ae14ffaea211c6ae4fbea

SHA1
dd258160c64d05a7ca9f9dd74580ed9663fde41b

SHA256
5de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54

SHA512
728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1

Download Submit
memory/3384-162-0x0000000002BF0000-0x0000000002CC7000-memory.dmp

Filesize
860KB

Download
memory/3384-161-0x0000000002BF0000-0x0000000002CC7000-memory.dmp

Filesize
860KB

Download
memory/3384-159-0x0000000002BF0000-0x0000000002CC7000-memory.dmp

Filesize
860KB

Download
memory/3384-157-0x0000000002B00000-0x0000000002BEF000-memory.dmp

Filesize
956KB

Download
memory/3384-156-0x0000000000A00000-0x0000000000A06000-memory.dmp

Filesize
24KB

Download
memory/4596-145-0x00000000012E0000-0x00000000012E6000-memory.dmp

Filesize
24KB

Download
memory/4596-152-0x0000000003240000-0x0000000003317000-memory.dmp

Filesize
860KB

Download
memory/4596-151-0x0000000003240000-0x0000000003317000-memory.dmp

Filesize
860KB

Download
memory/4596-149-0x0000000003240000-0x0000000003317000-memory.dmp

Filesize
860KB

Download
memory/4596-148-0x0000000003240000-0x0000000003317000-memory.dmp

Filesize
860KB

Download
memory/4596-147-0x0000000002BA0000-0x0000000002C8F000-memory.dmp

Filesize
956KB

Download
memory/4596-144-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing