a759dfe145751752776c392ad2f5dffd1fa7f4e77e3f5daeeb2258baa2271262

Analysis

max time kernel
78s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 880KB
Sample230321-al64dsga27
SHA256 a759dfe145751752776c392ad2f5dffd1fa7f4e77e3f5daeeb2258baa2271262
MD5 7e9d6867dfd8711952376aa02aaeb453
SHA1 a90cf5c5d9079716dde8b0c2be20dbd6fb0fbc3d
SHA512 94a0e3160fed3a977d631ee1b2c9c9cc2235fedab0ad7e1231ae837ccfbacc04d3a92e9a367dfe299bdf998bbb926667f84b013263acb41bf0debf23fed61674
SSDEEP 6144:LQuiA1RTz/cYja2ieb5YbF5R+Jn8xH97r7F/1d43wUmDm:nz/9ja2ieFYp5R+I7VY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	2692	rundll32.exe	51

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	file.exe

Loads dropped DLL 1 IoCs

pid	Process
4548	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	4548	WerFault.exe	86

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1948	file.exe
1948	file.exe
4380	file.exe
4380	file.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4380	1948	file.exe	84
PID 1948 wrote to memory of 4380	1948	file.exe	84
PID 1948 wrote to memory of 4380	1948	file.exe	84
PID 4500 wrote to memory of 4548	4500	rundll32.exe	86
PID 4500 wrote to memory of 4548	4500	rundll32.exe	86
PID 4500 wrote to memory of 4548	4500	rundll32.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe" -h
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4380

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 600
    3⤵
    - Program crash
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4548 -ip 4548
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 557KB
SHA256 555ced7986ad075033f84cf3b656143f7ca8194aa5824415d2d668123e59fac6
MD5 9dd748ec666aca6d3fee60839649fb02
SHA1 d09baa2751e2972fca1ded62d40823889ca8d41d
SHA512 1faff5e33104061a8479b4e03979e23c9814d14a19d780b5b6cdd81af5f371fcd6f96c8f08ba3760b7b660dcf9667e7e7e9f13284d119936bed046cc19c5fdb8
SSDEEP 12288:rUd0UAQgTkZYxdNLCjUqJYCTKTZmF5zRn5cxhD:rUddADm/jNOTZmF5zRGT
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
MD5 1b20e998d058e813dfc515867d31124f
SHA1 c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA512 79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6
SSDEEP 384:XehpWSsdMRgTh4QPt0RaYaGCp9FclU2sSadM7yjR+Lcuczw0RoR/5rdy7olDJfUw:ipW6+grtlU2v7yGLwwouflpZ2tVtkTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
MD5 1b20e998d058e813dfc515867d31124f
SHA1 c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA512 79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6
SSDEEP 384:XehpWSsdMRgTh4QPt0RaYaGCp9FclU2sSadM7yjR+Lcuczw0RoR/5rdy7olDJfUw:ipW6+grtlU2v7yGLwwouflpZ2tVtkTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads