703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e

Analysis

max time kernel
114s
max time network
24s
platform
windows7_x64
resource
win7v20201028
submitted
22/03/2021, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88F216EE25F70ED0704D8CC796ECD277.exe
Size 74KB
Sample210322-861bb2drk6
SHA256 703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e
MD5 88f216ee25f70ed0704d8cc796ecd277
SHA1 3e93b8236c7a6e82f50448b03f68d8ba662508f3
SHA512 fd80bd06d56f4653d5ffc5bfdc477133bbd4ab8c22916873227b1ae2db285f298ac78a537979b2e0e7107c8e5970c15fceea2c8bd5a622507dc0cbe19a8136b9
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1340	88F216EE25F70ED0704D8CC796ECD277.exe
1340	88F216EE25F70ED0704D8CC796ECD277.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1340	88F216EE25F70ED0704D8CC796ECD277.exe

C:\Users\Admin\AppData\Local\Temp\88F216EE25F70ED0704D8CC796ECD277.exe
"C:\Users\Admin\AppData\Local\Temp\88F216EE25F70ED0704D8CC796ECD277.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-2-0x0000000076691000-0x0000000076693000-memory.dmp

Download