Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07/02/2022, 21:38
Behavioral task
behavioral1
Sample
7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe
-
Size
1.9MB
-
MD5
0be35b571c6279490eedca5e68f77e56
-
SHA1
61f7734dd61dc1c5b113c5293cafa87fc4f2eea3
-
SHA256
7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f
-
SHA512
9f7bcf9931575278a9a86e67c83857902d3f822df589d346ef7050ed9c867a3747b82d1fc70d7eda069021daf10127767dce571a098aa6eb556a9f1d22f52231
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1208 2.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\Outerspace Software\BluffTitler 2.exe File created C:\Program Files\Outerspace Software\BluffTitler\__tmp_rar_sfx_access_check_259420770 2.exe File created C:\Program Files\Outerspace Software\BluffTitler\BluffTitler.exe 2.exe File opened for modification C:\Program Files\Outerspace Software\BluffTitler\BluffTitler.exe 2.exe File opened for modification C:\Program Files\Outerspace Software 2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1208 2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1532 wrote to memory of 1768 1532 7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe 27 PID 1532 wrote to memory of 1768 1532 7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe 27 PID 1532 wrote to memory of 1768 1532 7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe 27 PID 1532 wrote to memory of 1768 1532 7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe 27 PID 1768 wrote to memory of 1208 1768 cmd.exe 29 PID 1768 wrote to memory of 1208 1768 cmd.exe 29 PID 1768 wrote to memory of 1208 1768 cmd.exe 29 PID 1768 wrote to memory of 1208 1768 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe"C:\Users\Admin\AppData\Local\Temp\7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2AF7.tmp\2AF8.bat C:\Users\Admin\AppData\Local\Temp\7f21a04122b0cd93c1f8ffa63482c9c9d79def2a01c9a664f79dd7323d010d0f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp\2.exe2.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1208
-
-