Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    24-11-2021 14:07

General

  • Target

    GST-48B3.cmd.exe

  • Size

    1.4MB

  • MD5

    032f4480781e0ed708241d92d8b6c718

  • SHA1

    1b1e6009b1d1f76ce17197bbda33fedd6e0e1175

  • SHA256

    064fe665dce5b2cf6d824290c2fdebea593f26b0c4b05efbdd3e300ab926900f

  • SHA512

    6ad6d3f4e8c84f50f1931917da9027a3bbb7302caa923483888bf3c6cc073f82b649666b16d28a3ac3e154fdaea9d3d2a42a3b875ea4831f15ca14e0b74c071f

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GST-48B3.cmd.exe
    "C:\Users\Admin\AppData\Local\Temp\GST-48B3.cmd.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:660
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Receipt.bmp
      2⤵
        PID:760
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:1420

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/660-55-0x0000000000260000-0x0000000000266000-memory.dmp

      Filesize

      24KB

    • memory/660-56-0x0000000000260000-0x000000000026A000-memory.dmp

      Filesize

      40KB

    • memory/660-57-0x00000000758C1000-0x00000000758C3000-memory.dmp

      Filesize

      8KB

    • memory/760-58-0x0000000000000000-mapping.dmp

    • memory/760-61-0x0000000000580000-0x0000000000582000-memory.dmp

      Filesize

      8KB

    • memory/1420-62-0x0000000000170000-0x0000000000172000-memory.dmp

      Filesize

      8KB

    • memory/1420-63-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB