cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484

General

Target

cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe
Size

1.2MB
MD5

260ffc41b4439bd36b49f822bebdae1d
SHA1

9ab1a987238ee486909a0c2178b15fc6dafc36ca
SHA256

cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484
SHA512

9b3308a77b09e4cfcd064a5dade1e908bb69435650ccced84555c31480bcfba827af6e75e989d4423ed043513c01ba6eac6d13eff19194f7c176cf249b04627e
SSDEEP

24576:I/XEXjJSFHUKzf++YAZdwDaB5I5LNBvkPwurM7og+8Fe:I/oSzf6DrLNBvkoKMUmI

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe

Loads dropped DLL 4 IoCs

pid	Process
2112	rundll32.exe
2112	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4924	3120	cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe	86
PID 3120 wrote to memory of 4924	3120	cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe	86
PID 3120 wrote to memory of 4924	3120	cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe	86
PID 4924 wrote to memory of 2112	4924	control.exe	88
PID 4924 wrote to memory of 2112	4924	control.exe	88
PID 4924 wrote to memory of 2112	4924	control.exe	88
PID 2112 wrote to memory of 3540	2112	rundll32.exe	89
PID 2112 wrote to memory of 3540	2112	rundll32.exe	89
PID 3540 wrote to memory of 2008	3540	RunDll32.exe	90
PID 3540 wrote to memory of 2008	3540	RunDll32.exe	90
PID 3540 wrote to memory of 2008	3540	RunDll32.exe	90

C:\Users\Admin\AppData\Local\Temp\cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe
"C:\Users\Admin\AppData\Local\Temp\cae5eec9dbf9c8811083eb1cf27b3d2a02686848b48d5e91fb9da3452861f484.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\CZUp.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\CZUp.cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\CZUp.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\CZUp.cpl",
        5⤵
        Loads dropped DLL
        
        PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CZUp.cpl

Filesize
1.0MB

MD5
d9115fe00923797f53c5119a82f7bd8f

SHA1
ad54956353d133bac0bbe439ce1ba68a1526ae4e

SHA256
8cceecb70504035170ab827c0fea9155576202b03f128a0532730dc5aa43f07f

SHA512
0cd22589a07a95bbd4a46fd730717fa407d5d908853fec2e3a811caa8de859c40c4a2297fe494c64515a5e2ed2ba5db8d14ca2052375db67fff125cdff242d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\CZUp.cpl

Filesize
1.0MB

MD5
d9115fe00923797f53c5119a82f7bd8f

SHA1
ad54956353d133bac0bbe439ce1ba68a1526ae4e

SHA256
8cceecb70504035170ab827c0fea9155576202b03f128a0532730dc5aa43f07f

SHA512
0cd22589a07a95bbd4a46fd730717fa407d5d908853fec2e3a811caa8de859c40c4a2297fe494c64515a5e2ed2ba5db8d14ca2052375db67fff125cdff242d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\CZUp.cpl

Filesize
1.0MB

MD5
d9115fe00923797f53c5119a82f7bd8f

SHA1
ad54956353d133bac0bbe439ce1ba68a1526ae4e

SHA256
8cceecb70504035170ab827c0fea9155576202b03f128a0532730dc5aa43f07f

SHA512
0cd22589a07a95bbd4a46fd730717fa407d5d908853fec2e3a811caa8de859c40c4a2297fe494c64515a5e2ed2ba5db8d14ca2052375db67fff125cdff242d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\CZUp.cpl

Filesize
1.0MB

MD5
d9115fe00923797f53c5119a82f7bd8f

SHA1
ad54956353d133bac0bbe439ce1ba68a1526ae4e

SHA256
8cceecb70504035170ab827c0fea9155576202b03f128a0532730dc5aa43f07f

SHA512
0cd22589a07a95bbd4a46fd730717fa407d5d908853fec2e3a811caa8de859c40c4a2297fe494c64515a5e2ed2ba5db8d14ca2052375db67fff125cdff242d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\CZUp.cpl

Filesize
1.0MB

MD5
d9115fe00923797f53c5119a82f7bd8f

SHA1
ad54956353d133bac0bbe439ce1ba68a1526ae4e

SHA256
8cceecb70504035170ab827c0fea9155576202b03f128a0532730dc5aa43f07f

SHA512
0cd22589a07a95bbd4a46fd730717fa407d5d908853fec2e3a811caa8de859c40c4a2297fe494c64515a5e2ed2ba5db8d14ca2052375db67fff125cdff242d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\CZUp.cpl

Filesize
1.0MB

MD5
d9115fe00923797f53c5119a82f7bd8f

SHA1
ad54956353d133bac0bbe439ce1ba68a1526ae4e

SHA256
8cceecb70504035170ab827c0fea9155576202b03f128a0532730dc5aa43f07f

SHA512
0cd22589a07a95bbd4a46fd730717fa407d5d908853fec2e3a811caa8de859c40c4a2297fe494c64515a5e2ed2ba5db8d14ca2052375db67fff125cdff242d62

Download Submit
memory/2008-165-0x00000000030C0000-0x0000000003183000-memory.dmp

Filesize
780KB

Download
memory/2008-163-0x00000000030C0000-0x0000000003183000-memory.dmp

Filesize
780KB

Download
memory/2008-161-0x0000000002FE0000-0x00000000030BA000-memory.dmp

Filesize
872KB

Download
memory/2008-160-0x0000000002800000-0x0000000002806000-memory.dmp

Filesize
24KB

Download
memory/2008-158-0x0000000002CF0000-0x0000000002DF7000-memory.dmp

Filesize
1.0MB

Download
memory/2008-157-0x0000000002CF0000-0x0000000002DF7000-memory.dmp

Filesize
1.0MB

Download
memory/2008-166-0x00000000030C0000-0x0000000003183000-memory.dmp

Filesize
780KB

Download
memory/2112-146-0x0000000002C70000-0x0000000002D77000-memory.dmp

Filesize
1.0MB

Download
memory/2112-154-0x0000000003040000-0x0000000003103000-memory.dmp

Filesize
780KB

Download
memory/2112-153-0x0000000003040000-0x0000000003103000-memory.dmp

Filesize
780KB

Download
memory/2112-151-0x0000000003040000-0x0000000003103000-memory.dmp

Filesize
780KB

Download
memory/2112-150-0x0000000003040000-0x0000000003103000-memory.dmp

Filesize
780KB

Download
memory/2112-149-0x0000000002F60000-0x000000000303A000-memory.dmp

Filesize
872KB

Download
memory/2112-148-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

Filesize
24KB

Download
memory/2112-145-0x0000000002C70000-0x0000000002D77000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing