a759dfe145751752776c392ad2f5dffd1fa7f4e77e3f5daeeb2258baa2271262

Analysis

max time kernel
78s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

880KB
MD5

7e9d6867dfd8711952376aa02aaeb453
SHA1

a90cf5c5d9079716dde8b0c2be20dbd6fb0fbc3d
SHA256

a759dfe145751752776c392ad2f5dffd1fa7f4e77e3f5daeeb2258baa2271262
SHA512

94a0e3160fed3a977d631ee1b2c9c9cc2235fedab0ad7e1231ae837ccfbacc04d3a92e9a367dfe299bdf998bbb926667f84b013263acb41bf0debf23fed61674
SSDEEP

6144:LQuiA1RTz/cYja2ieb5YbF5R+Jn8xH97r7F/1d43wUmDm:nz/9ja2ieFYp5R+I7VY

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	2692	rundll32.exe	51

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	file.exe

Loads dropped DLL 1 IoCs

pid	Process
4548	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	4548	WerFault.exe	86

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1948	file.exe
1948	file.exe
4380	file.exe
4380	file.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4380	1948	file.exe	84
PID 1948 wrote to memory of 4380	1948	file.exe	84
PID 1948 wrote to memory of 4380	1948	file.exe	84
PID 4500 wrote to memory of 4548	4500	rundll32.exe	86
PID 4500 wrote to memory of 4548	4500	rundll32.exe	86
PID 4500 wrote to memory of 4548	4500	rundll32.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe" -h
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4380

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 600
    3⤵
    - Program crash
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4548 -ip 4548
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\db.dat

Filesize
557KB

MD5
9dd748ec666aca6d3fee60839649fb02

SHA1
d09baa2751e2972fca1ded62d40823889ca8d41d

SHA256
555ced7986ad075033f84cf3b656143f7ca8194aa5824415d2d668123e59fac6

SHA512
1faff5e33104061a8479b4e03979e23c9814d14a19d780b5b6cdd81af5f371fcd6f96c8f08ba3760b7b660dcf9667e7e7e9f13284d119936bed046cc19c5fdb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit