8b6d377018f824f8ccd03b8f1b68e2dbd40a6228f5ac6fb1a4eb032d9fd6771c

Analysis

max time kernel
152s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
10/12/2023, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.8MB
Sample231210-14259sdfcp
SHA256 8b6d377018f824f8ccd03b8f1b68e2dbd40a6228f5ac6fb1a4eb032d9fd6771c
MD5 11e6ca562d2286de19628a208d2dfae7
SHA1 d8e8b9c2262b8b7f6608032585deb27c7b209d83
SHA512 208d54179650cd466c69c54e01215ee1f0aa1c9b5e70a0e57a72657a6c55825ab60b2504853d5082b5b01f57470c25f7d2e71aff045f55f2ae3735f5ef2b58e7
SSDEEP 49152:yeE26znZddiZIegGxPMMeQgzKLXnYLxRVO1G4AE8+x3GnsF27sXgeoEyM6wz/oq:ye6wREQmKiRVO1R/XdGnsF27Egyywzz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
3468	rundll32.exe
1400	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2224	2264	file.exe	91
PID 2264 wrote to memory of 2224	2264	file.exe	91
PID 2264 wrote to memory of 2224	2264	file.exe	91
PID 2224 wrote to memory of 1316	2224	cmd.exe	94
PID 2224 wrote to memory of 1316	2224	cmd.exe	94
PID 2224 wrote to memory of 1316	2224	cmd.exe	94
PID 1316 wrote to memory of 3468	1316	control.exe	96
PID 1316 wrote to memory of 3468	1316	control.exe	96
PID 1316 wrote to memory of 3468	1316	control.exe	96
PID 3468 wrote to memory of 3364	3468	rundll32.exe	104
PID 3468 wrote to memory of 3364	3468	rundll32.exe	104
PID 3364 wrote to memory of 1400	3364	RunDll32.exe	106
PID 3364 wrote to memory of 1400	3364	RunDll32.exe	106
PID 3364 wrote to memory of 1400	3364	RunDll32.exe	106

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z85DE78D8\1.BAt" "
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7z85DE78D8\BPcOp.cPl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z85DE78D8\BPcOp.cPl",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z85DE78D8\BPcOp.cPl",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3364
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z85DE78D8\BPcOp.cPl",
        6⤵
        Loads dropped DLL
        
        PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.BAt

Path C:\Users\Admin\AppData\Local\Temp\7z85DE78D8\1.BAt
Size 62B
SHA256 ede9fb37c34f84cedcb0b799f26f1e0c554993e961eacf59d9b475ddb4ea2731
MD5 f7bce5741b4e4d2e94d083020b84810b
SHA1 a65ef5e5ea4538003da14f1904a164484b76a1b1
SHA512 86ad2873f87fd29019274547e7d0c688833c51d0794fd2ddf8d59baa360ac503ce81d0b58dec9863a934e253d5b1fcd5be174ca9149bdccecf9d9c9484d5bc07
MD5 SHA1 SHA512

Submit Download

BPcOp.cPl

Path C:\Users\Admin\AppData\Local\Temp\7z85DE78D8\BPcOp.cPl
Size 3.2MB
SHA256 fa3395bacf7d767dbe1eecc6ead14da773db2ded3e8cebf67bc157597583450c
MD5 1f8e8176f8b81ad723724353f5429add
SHA1 859c8ca6d2ee8102461591fbda6e18b84ceeb412
SHA512 9526e2fde1c2235093a09847556f38330ec1b95604c9a39439d4b3de17fb8b0e96fe0fb92ed77cb76a6067f089360707ada13dba3f9f60a0d9226b23306afd46
SSDEEP 49152:ggL6xisyzVeDArdHS1dNc7JaPALA3t3ZjrZAFxurjRndJJyL2WfO1dekw4LRsw:ais4Ves5ooe+A3t3ZOPAtnfQL2l8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1400-19-0x00000000016C0000-0x00000000016C6000-memory.dmp

Download

memory/1400-27-0x0000000003790000-0x00000000038B9000-memory.dmp

Download

memory/1400-26-0x0000000003790000-0x00000000038B9000-memory.dmp

Download

memory/1400-23-0x0000000003790000-0x00000000038B9000-memory.dmp

Download

memory/1400-22-0x0000000003640000-0x0000000003786000-memory.dmp

Download

memory/3468-9-0x00000000023D0000-0x00000000023D6000-memory.dmp

Download

memory/3468-17-0x0000000002DD0000-0x0000000002EF9000-memory.dmp

Download

memory/3468-16-0x0000000002DD0000-0x0000000002EF9000-memory.dmp

Download

memory/3468-13-0x0000000002DD0000-0x0000000002EF9000-memory.dmp

Download

memory/3468-12-0x0000000002C80000-0x0000000002DC6000-memory.dmp

Download

memory/3468-10-0x0000000010000000-0x0000000010331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads