c3b9a8dde21bf3c1bb09426a261c77eb4b59cb2f36ac82e5b8f6b4a4d3565b5b

Analysis

max time kernel
116s
max time network
52s
platform
windows7_x64
resource
win7v20210408
submitted
28-09-2021 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

267667a4bbfdfcf20c407c2b191fd0ed.exe
Size

371KB
MD5

267667a4bbfdfcf20c407c2b191fd0ed
SHA1

73870de4caa2eaaf162c81c34740527e12b8467c
SHA256

c3b9a8dde21bf3c1bb09426a261c77eb4b59cb2f36ac82e5b8f6b4a4d3565b5b
SHA512

604c56940caf033ea9132067f47030272042c22d73c4ea8744508e75cca5d6c6058c917c32f72b0e29cecb2c5349e52a111af15f21990d2089f4ed098773565d

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1796 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1796	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

267667a4bbfdfcf20c407c2b191fd0ed.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	267667a4bbfdfcf20c407c2b191fd0ed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	267667a4bbfdfcf20c407c2b191fd0ed.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1792 timeout.exe

pid	process
1792	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

267667a4bbfdfcf20c407c2b191fd0ed.execmd.exe

description	pid	process	target process
PID 1992 wrote to memory of 1796	1992	267667a4bbfdfcf20c407c2b191fd0ed.exe	cmd.exe
PID 1992 wrote to memory of 1796	1992	267667a4bbfdfcf20c407c2b191fd0ed.exe	cmd.exe
PID 1992 wrote to memory of 1796	1992	267667a4bbfdfcf20c407c2b191fd0ed.exe	cmd.exe
PID 1992 wrote to memory of 1796	1992	267667a4bbfdfcf20c407c2b191fd0ed.exe	cmd.exe
PID 1796 wrote to memory of 1792	1796	cmd.exe	timeout.exe
PID 1796 wrote to memory of 1792	1796	cmd.exe	timeout.exe
PID 1796 wrote to memory of 1792	1796	cmd.exe	timeout.exe
PID 1796 wrote to memory of 1792	1796	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\267667a4bbfdfcf20c407c2b191fd0ed.exe
"C:\Users\Admin\AppData\Local\Temp\267667a4bbfdfcf20c407c2b191fd0ed.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\mGfAhlTYoqgZw & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\267667a4bbfdfcf20c407c2b191fd0ed.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1792

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-63-0x0000000000000000-mapping.dmp

Download
memory/1796-62-0x0000000000000000-mapping.dmp

Download
memory/1992-59-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1992-60-0x00000000002C0000-0x0000000000306000-memory.dmp

Filesize
280KB

Download
memory/1992-61-0x0000000000400000-0x0000000002BA5000-memory.dmp

Filesize
39.6MB

Download