6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed

Analysis

max time kernel
102s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2023, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed.exe
Size

1.3MB
MD5

5ee4edb503e48a634d980d13963f3c0e
SHA1

f70d146cb66deed70baba953119b99f7a88a6104
SHA256

6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed
SHA512

ff20bfddc0b0d0543e44c4f77872f1414dff882bf6bd18a44bbff5ddb16f816a257d18e821873b54522eb0eae68b470cff4675fde3888f0d370ce6de9f82c085
SSDEEP

24576:I/XEXjJSFHUKjcUpORanaYtYddBTgHJIgNKoTLPfDMTqHk7p5s:I/oSfBnaUYddBEG4KoTLPfDMV7py

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed.exe

Loads dropped DLL 2 IoCs

pid	Process
1336	regsvr32.exe
1336	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1336	1872	6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed.exe	84
PID 1872 wrote to memory of 1336	1872	6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed.exe	84
PID 1872 wrote to memory of 1336	1872	6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed.exe	84

C:\Users\Admin\AppData\Local\Temp\6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed.exe
"C:\Users\Admin\AppData\Local\Temp\6dec6db60265e1242bd7a7e06b4b26a51f866cb08aec465a26e99d3e8906bbed.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" .\MIVh.5hO /s
  2⤵
  - Loads dropped DLL
  PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MIVh.5hO

Filesize
1.1MB

MD5
bc33abbdff22f8a5d81b83ba1a8c71dc

SHA1
84a6e3ce58a3c88b6238c46b2b20b6f049483c8b

SHA256
79dc42b146f9a7f4ec82ab03991286abdf96dae8058e0249a1e1ade12bd18d37

SHA512
8a2eeca9e51e82305b7a7362c1802a40b6815ef0d1e09d711a7c8e381fcdec4148fa3eb49bcf3161ffafb5152716d6ba352a42f5b0747c924527b87efb1b3177

Download Submit
C:\Users\Admin\AppData\Local\Temp\MIVh.5hO

Filesize
1.1MB

MD5
bc33abbdff22f8a5d81b83ba1a8c71dc

SHA1
84a6e3ce58a3c88b6238c46b2b20b6f049483c8b

SHA256
79dc42b146f9a7f4ec82ab03991286abdf96dae8058e0249a1e1ade12bd18d37

SHA512
8a2eeca9e51e82305b7a7362c1802a40b6815ef0d1e09d711a7c8e381fcdec4148fa3eb49bcf3161ffafb5152716d6ba352a42f5b0747c924527b87efb1b3177

Download Submit
C:\Users\Admin\AppData\Local\Temp\MIVh.5hO

Filesize
1.1MB

MD5
bc33abbdff22f8a5d81b83ba1a8c71dc

SHA1
84a6e3ce58a3c88b6238c46b2b20b6f049483c8b

SHA256
79dc42b146f9a7f4ec82ab03991286abdf96dae8058e0249a1e1ade12bd18d37

SHA512
8a2eeca9e51e82305b7a7362c1802a40b6815ef0d1e09d711a7c8e381fcdec4148fa3eb49bcf3161ffafb5152716d6ba352a42f5b0747c924527b87efb1b3177

Download Submit
memory/1336-138-0x0000000002020000-0x000000000212F000-memory.dmp

Filesize
1.1MB

Download
memory/1336-139-0x0000000002020000-0x000000000212F000-memory.dmp

Filesize
1.1MB

Download
memory/1336-141-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/1336-142-0x0000000002020000-0x000000000212F000-memory.dmp

Filesize
1.1MB

Download
memory/1336-143-0x0000000002480000-0x0000000002562000-memory.dmp

Filesize
904KB

Download
memory/1336-144-0x0000000002580000-0x000000000264D000-memory.dmp

Filesize
820KB

Download
memory/1336-147-0x0000000002580000-0x000000000264D000-memory.dmp

Filesize
820KB

Download
memory/1336-148-0x0000000002580000-0x000000000264D000-memory.dmp

Filesize
820KB

Download