5b3942ea4634d2a3dbc134b35912477ee6e68565bcd97f6f96c067bde5735979

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211208
submitted
10/02/2022, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
410a8dd39153d54431176c2594fcd42b.exe
Size 288KB
Sample220210-kbaybageh3
SHA256 5b3942ea4634d2a3dbc134b35912477ee6e68565bcd97f6f96c067bde5735979
MD5 410a8dd39153d54431176c2594fcd42b
SHA1 f7c4b616790178e0c08a7bd03327ff98e7adcabf
SHA512 a51c02bd165ac2770ff5fb4d5a97986b02ab1e7220bcd4874f27e8012d55d30602af13c751e3abb1feece77e7faf0ec50b1a23490b9cff2bfdd08c94cadab42d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
516	tjwgwwbkjh.exe

Loads dropped DLL 2 IoCs

pid	Process
1680	410a8dd39153d54431176c2594fcd42b.exe
516	tjwgwwbkjh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 516	1680	410a8dd39153d54431176c2594fcd42b.exe	27
PID 1680 wrote to memory of 516	1680	410a8dd39153d54431176c2594fcd42b.exe	27
PID 1680 wrote to memory of 516	1680	410a8dd39153d54431176c2594fcd42b.exe	27
PID 1680 wrote to memory of 516	1680	410a8dd39153d54431176c2594fcd42b.exe	27
PID 516 wrote to memory of 432	516	tjwgwwbkjh.exe	28
PID 516 wrote to memory of 432	516	tjwgwwbkjh.exe	28
PID 516 wrote to memory of 432	516	tjwgwwbkjh.exe	28
PID 516 wrote to memory of 432	516	tjwgwwbkjh.exe	28

C:\Users\Admin\AppData\Local\Temp\410a8dd39153d54431176c2594fcd42b.exe
"C:\Users\Admin\AppData\Local\Temp\410a8dd39153d54431176c2594fcd42b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\tjwgwwbkjh.exe
  C:\Users\Admin\AppData\Local\Temp\tjwgwwbkjh.exe C:\Users\Admin\AppData\Local\Temp\ritzoccffl
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Users\Admin\AppData\Local\Temp\tjwgwwbkjh.exe
    C:\Users\Admin\AppData\Local\Temp\tjwgwwbkjh.exe C:\Users\Admin\AppData\Local\Temp\ritzoccffl
    3⤵
    PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/516-61-0x0000000000090000-0x0000000000092000-memory.dmp

Download

memory/1680-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp