Resubmissions

16-09-2021 17:11

210916-vqc2bsgffp 8

29-07-2020 07:17

200729-r3t8er9v4n 8

Analysis

  • max time kernel
    151s
  • max time network
    6s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    29-07-2020 07:17

General

  • Target

    09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe

  • Size

    64KB

  • MD5

    aa0d25108c420b68af8a98d877a10e9a

  • SHA1

    b4a9c79567a508254953a024ac284c12ce57873b

  • SHA256

    09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768

  • SHA512

    b00f2e9c3d1a343b257a423a5fdf9aa4be82b11b94657d2bd88c056da80b34903aa103c34eeca5e5cffab81d92e53c4209765f25cadab38cc0df049d2b1e07d2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe
    "C:\Users\Admin\AppData\Local\Temp\09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:108
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:1524
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        2⤵
          PID:1508

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1524-0-0x0000000000000000-mapping.dmp