Analysis
-
max time kernel
103s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2023 02:33
Static task
static1
Behavioral task
behavioral1
Sample
12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe
Resource
win10v2004-20230220-en
General
-
Target
12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe
-
Size
1.4MB
-
MD5
a781c1ab5e2af665c8f300acafc0d30b
-
SHA1
f3a4ec427bcf014ae106e5be6cd730455b4b0648
-
SHA256
12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013
-
SHA512
6e1f450364125e4d01f6974802d84dc5a6ee2d0ebd9c245cd52982e79d3d6a7563265c840d7a99802cf35ba1237d5070f67321c8376d43a2e04340b7a9980c60
-
SSDEEP
24576:gJr8tE+gHqwk4c9A8xO3F8f2I5SITbJ4bfXf5gELIXlgLHcBFqb4h6h4:gJ4NwkyTq2I5S4YP5dYuLHcBG4Z
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3920 rundll32.exe 1528 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings 12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.execontrol.exerundll32.exeRunDll32.exedescription pid process target process PID 1920 wrote to memory of 724 1920 12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe control.exe PID 1920 wrote to memory of 724 1920 12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe control.exe PID 1920 wrote to memory of 724 1920 12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe control.exe PID 724 wrote to memory of 3920 724 control.exe rundll32.exe PID 724 wrote to memory of 3920 724 control.exe rundll32.exe PID 724 wrote to memory of 3920 724 control.exe rundll32.exe PID 3920 wrote to memory of 4600 3920 rundll32.exe RunDll32.exe PID 3920 wrote to memory of 4600 3920 rundll32.exe RunDll32.exe PID 4600 wrote to memory of 1528 4600 RunDll32.exe rundll32.exe PID 4600 wrote to memory of 1528 4600 RunDll32.exe rundll32.exe PID 4600 wrote to memory of 1528 4600 RunDll32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe"C:\Users\Admin\AppData\Local\Temp\12b1836eed49729bf60b87f0ed65e6b1a74fb77152d1c7974ca46692c08b1013.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\19PG.cpl",2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\19PG.cpl",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\19PG.cpl",4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\19PG.cpl",5⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\19PG.cplFilesize
1.1MB
MD51a0915cb3e900744e61ceb1c36587839
SHA1307ea89fb0b7d63fd59e927119c2e4afdc44a775
SHA25681fc5a7cecbf513db7ae4c569542eb8f852a9b072f056403887483458119d129
SHA51210666487c9c4f79be8f92f85a4dec90a8b51a6963659b9d0a07678328dbe96a7a9e16f63dce03414e06d060f081c76aa8c14f4af8cb6efac440b640473488307
-
C:\Users\Admin\AppData\Local\Temp\19pg.cplFilesize
1.1MB
MD51a0915cb3e900744e61ceb1c36587839
SHA1307ea89fb0b7d63fd59e927119c2e4afdc44a775
SHA25681fc5a7cecbf513db7ae4c569542eb8f852a9b072f056403887483458119d129
SHA51210666487c9c4f79be8f92f85a4dec90a8b51a6963659b9d0a07678328dbe96a7a9e16f63dce03414e06d060f081c76aa8c14f4af8cb6efac440b640473488307
-
C:\Users\Admin\AppData\Local\Temp\19pg.cplFilesize
1.1MB
MD51a0915cb3e900744e61ceb1c36587839
SHA1307ea89fb0b7d63fd59e927119c2e4afdc44a775
SHA25681fc5a7cecbf513db7ae4c569542eb8f852a9b072f056403887483458119d129
SHA51210666487c9c4f79be8f92f85a4dec90a8b51a6963659b9d0a07678328dbe96a7a9e16f63dce03414e06d060f081c76aa8c14f4af8cb6efac440b640473488307
-
C:\Users\Admin\AppData\Local\Temp\19pg.cplFilesize
1.1MB
MD51a0915cb3e900744e61ceb1c36587839
SHA1307ea89fb0b7d63fd59e927119c2e4afdc44a775
SHA25681fc5a7cecbf513db7ae4c569542eb8f852a9b072f056403887483458119d129
SHA51210666487c9c4f79be8f92f85a4dec90a8b51a6963659b9d0a07678328dbe96a7a9e16f63dce03414e06d060f081c76aa8c14f4af8cb6efac440b640473488307
-
memory/1528-162-0x00000000033B0000-0x000000000348B000-memory.dmpFilesize
876KB
-
memory/1528-161-0x00000000033B0000-0x000000000348B000-memory.dmpFilesize
876KB
-
memory/1528-159-0x00000000033B0000-0x000000000348B000-memory.dmpFilesize
876KB
-
memory/1528-157-0x00000000032B0000-0x00000000033A3000-memory.dmpFilesize
972KB
-
memory/1528-156-0x0000000002BC0000-0x0000000002BC6000-memory.dmpFilesize
24KB
-
memory/3920-146-0x00000000031C0000-0x00000000032B3000-memory.dmpFilesize
972KB
-
memory/3920-152-0x00000000032D0000-0x00000000033AB000-memory.dmpFilesize
876KB
-
memory/3920-151-0x00000000032D0000-0x00000000033AB000-memory.dmpFilesize
876KB
-
memory/3920-149-0x00000000032D0000-0x00000000033AB000-memory.dmpFilesize
876KB
-
memory/3920-148-0x00000000032D0000-0x00000000033AB000-memory.dmpFilesize
876KB
-
memory/3920-147-0x0000000002B40000-0x0000000002B46000-memory.dmpFilesize
24KB
-
memory/3920-144-0x0000000000400000-0x0000000000525000-memory.dmpFilesize
1.1MB