Overview

overview

10

Static

static

049263e712...6c.exe

windows7_x64

10

049263e712...6c.exe

windows10_x64

10

2a2eb971b8...d0.exe

windows7_x64

10

2a2eb971b8...d0.exe

windows10_x64

10

32d6be4f86...f3.exe

windows7_x64

10

32d6be4f86...f3.exe

windows10_x64

10

39ef1d9afd...d8.exe

windows7_x64

10

39ef1d9afd...d8.exe

windows10_x64

10

3a83805e3a...7e.exe

windows7_x64

10

3a83805e3a...7e.exe

windows10_x64

10

d1b6ee9b71...2b.exe

windows7_x64

10

d1b6ee9b71...2b.exe

windows10_x64

10

Analysis

  • max time kernel
    32s
  • max time network
    81s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    16-06-2021 05:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a2eb971b878f56a0a5762656be6f59ec9623451acf4cf16b8c02e478d044cd0.exe

  • Size

    501KB

  • MD5

    3f478dec46b01ca3cae11e238095c325

  • SHA1

    62c19bfdeefa22c9cb81b4e4d1a34f10fb41a32b

  • SHA256

    2a2eb971b878f56a0a5762656be6f59ec9623451acf4cf16b8c02e478d044cd0

  • SHA512

    f3ed3c1ede86bd4b113fe5ebcd27b79863408132c92ad583e9118604f7914eeb3ba1201e8d48ab641a6de49104e9dd7547369936bbe532a6826404e835856470

Score
10/10
mespinozaransomwarespywarestealer

Malware Config

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a2eb971b878f56a0a5762656be6f59ec9623451acf4cf16b8c02e478d044cd0.exe
    "C:\Users\Admin\AppData\Local\Temp\2a2eb971b878f56a0a5762656be6f59ec9623451acf4cf16b8c02e478d044cd0.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1672
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • Deletes itself
      PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Data Encrypted for Impact

1
T1486

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\update.bat
    MD5

    c05534f4724dc288d497d475ce846e38

    SHA1

    b2faec0a0610260ec162dd2a68e738ed138d86c8

    SHA256

    e8589ef6a93ed0b4e068988206efbe584f0bbd9fa780a6fb0250957d299f29d6

    SHA512

    9cf586d68a213f5d794439f1d5bd7ff87c156081d79691ab89a80773a17541f189b860692ebfcd3f40a6a7e5f2be1fafd0064eb28cfb5ed00155d51da94e2451

    Download Submit
  • memory/1132-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1672-60-0x00000000767B1000-0x00000000767B3000-memory.dmp
    Filesize

    8KB

    Download