8892709206b1488a8859080c914f05419d1f094148bacec1abe2f1b18a0ec7b1 | Triage

Resubmissions

09-11-2020 08:05

201109-tr9dpdpf8a 8

09-11-2020 08:01

201109-1l52bhwpfe 8

Analysis

max time kernel
25s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 08:05

Sharing

Report Analysis Logs

General

Target

8892709206b1488a8859080c914f05419d1f094148bacec1abe2f1b18a0ec7b1.bin.sample.exe
Size

966KB
MD5

a70c0b2b2f978a488216909f18b9a942
SHA1

8529c643ccc52008504baf7b55e0d37f8081fd7a
SHA256

8892709206b1488a8859080c914f05419d1f094148bacec1abe2f1b18a0ec7b1
SHA512

4e36d64233226595a2271381b6417d2e294001d98dfe21db88adad40aca205c5c2928506955d24d132fef0ee725571b96d0f65b6a423e39e080f73846ffab5ad

Score

7^/10

spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

916 NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\8892709206b1488a8859080c914f05419d1f094148bacec1abe2f1b18a0ec7b1.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\8892709206b1488a8859080c914f05419d1f094148bacec1abe2f1b18a0ec7b1.bin.sample.exe"
1⤵
PID:752

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.TXT
1⤵
- Opens file in notepad (likely ransom note)
PID:916

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\README.TXT
MD5
4eebee90a99037b6527e488fa94fbc75

SHA1
a8d607e6ab732d65d855f7cb16844bc57acb155a

SHA256
2bb3cca6da2d3dd804edbfc6cf6c6f8d20f84f01dfed9b04b02cbcf295fcfed8

SHA512
f769a5999afa8e9b18daa886720eadaaa513fd5127159b4c3398de759bd2f7ad62064a7da9f0364278c755a25eff9a63c6b5478f2b5a0c2e715a1cb6712cbbd3

Download Submit
memory/1764-1-0x000007FEF6350000-0x000007FEF65CA000-memory.dmp

Filesize
2.5MB

Download