Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2023, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe
Resource
win10v2004-20230220-en
General
-
Target
ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe
-
Size
1.5MB
-
MD5
9f9e211936405eb8a82f1d5994410fe3
-
SHA1
0d89d49e105f0f5969e5130ee548a4c1b8f5371d
-
SHA256
ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043
-
SHA512
8bb77ac69203392b9282756f9f5b143207775fed3450a19758b505076eb3837a515473d2372fa28991a5a79317ee8a8af70e95abd907d746cec4e3b86fb7400e
-
SSDEEP
24576:gJr8tE+gHqYxcvENb94f5m2j1GkY5YNeGTsU11OF9KFHihG6A5aJns7YZdOhIUZ2:gJ4NYxl/4ImgdJGAs9H950ns7YZAhIE2
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe -
Loads dropped DLL 2 IoCs
pid Process 4596 rundll32.exe 3384 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1764 wrote to memory of 656 1764 ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe 86 PID 1764 wrote to memory of 656 1764 ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe 86 PID 1764 wrote to memory of 656 1764 ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe 86 PID 656 wrote to memory of 4596 656 control.exe 88 PID 656 wrote to memory of 4596 656 control.exe 88 PID 656 wrote to memory of 4596 656 control.exe 88 PID 4596 wrote to memory of 2436 4596 rundll32.exe 89 PID 4596 wrote to memory of 2436 4596 rundll32.exe 89 PID 2436 wrote to memory of 3384 2436 RunDll32.exe 90 PID 2436 wrote to memory of 3384 2436 RunDll32.exe 90 PID 2436 wrote to memory of 3384 2436 RunDll32.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe"C:\Users\Admin\AppData\Local\Temp\ae6c7cb66d2ce9ae045c4e8a75c7e28b23185e2ff8fe45fe32e3c802e87f9043.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",2⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",4⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\8~2F.cpL",5⤵
- Loads dropped DLL
PID:3384
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD582be888c141ae14ffaea211c6ae4fbea
SHA1dd258160c64d05a7ca9f9dd74580ed9663fde41b
SHA2565de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54
SHA512728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1
-
Filesize
1.2MB
MD582be888c141ae14ffaea211c6ae4fbea
SHA1dd258160c64d05a7ca9f9dd74580ed9663fde41b
SHA2565de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54
SHA512728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1
-
Filesize
1.2MB
MD582be888c141ae14ffaea211c6ae4fbea
SHA1dd258160c64d05a7ca9f9dd74580ed9663fde41b
SHA2565de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54
SHA512728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1
-
Filesize
1.2MB
MD582be888c141ae14ffaea211c6ae4fbea
SHA1dd258160c64d05a7ca9f9dd74580ed9663fde41b
SHA2565de86d3c6d2dcfc2cafd9540f7633e1b45c1aed3e7459e02c27414b730b15e54
SHA512728ebca7beebd524a1c78a99371ed050c845496c015323c939f2076235b1c6ec8941d6bbb1ff80f110f3c88a7a72c48b02fd85b8d135897758f9679c423e85a1