e3b25e21c6d04b5f2d72025c7956dbc3a4a5613f3b8d7ab8d0010bc3d437bc1b

Analysis

max time kernel
136s
max time network
108s
platform
windows7_x64
resource
win7v20210408
submitted
26-09-2021 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baa34a47a3e304011252780a85ae56be.exe
Size

257KB
MD5

baa34a47a3e304011252780a85ae56be
SHA1

77aaae6ca43345f9dd9871c637176634b4ec5f09
SHA256

e3b25e21c6d04b5f2d72025c7956dbc3a4a5613f3b8d7ab8d0010bc3d437bc1b
SHA512

6c0e07dbf351b5c04d50e08c9f684559f14982096762f1bbc64d4ffe86f6adf0bcf080f08b1032ced59dd3abe47d8701a9d99efc92d6b6c854d879fec6f246d9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

baa34a47a3e304011252780a85ae56be.exe

pid process

1968 baa34a47a3e304011252780a85ae56be.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

baa34a47a3e304011252780a85ae56be.exe

pid process

1968 baa34a47a3e304011252780a85ae56be.exe
1968 baa34a47a3e304011252780a85ae56be.exe

pid	process
1968	baa34a47a3e304011252780a85ae56be.exe

pid	process
1968	baa34a47a3e304011252780a85ae56be.exe
1968	baa34a47a3e304011252780a85ae56be.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

baa34a47a3e304011252780a85ae56be.exe

description	pid	process	target process
PID 1968 wrote to memory of 1996	1968	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 1968 wrote to memory of 1996	1968	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 1968 wrote to memory of 1996	1968	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 1968 wrote to memory of 1996	1968	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 1968 wrote to memory of 1996	1968	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\baa34a47a3e304011252780a85ae56be.exe
"C:\Users\Admin\AppData\Local\Temp\baa34a47a3e304011252780a85ae56be.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\baa34a47a3e304011252780a85ae56be.exe"
2⤵
PID:1996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsaE33D.tmp\rocn.dll
MD5
20e0ca41c8419f551c52aa86700b5074

SHA1
e2a47c15342f874e051b18b577eca2c49ab99782

SHA256
fde9673e0878783412ae8d1848316601f2f3b567a3688694b42d745fe18f14a0

SHA512
0a726b78493a0f8ba01133d12670977e51fc1f1d878b0e389c59f03cb80decb5d50411a88058d6e466c9cfe1ca02c1ffbdb9f1fb855249c0cc351efcc4541a28

Download Submit
memory/1968-60-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download