Overview

overview

10

Static

static

10

8b4b233e87...91.exe

windows7_x64

10

8b4b233e87...91.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    91s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    05-03-2022 22:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b4b233e87c61c8698e086b376da640c9ab2ecd71c58b1f6a2eceb60b7e1a691.exe

  • Size

    500KB

  • MD5

    dc82cd73d0738cfe2e49c499c2fa631e

  • SHA1

    81d1497490ee1ae20b2c87dff48cee31cdc4466f

  • SHA256

    8b4b233e87c61c8698e086b376da640c9ab2ecd71c58b1f6a2eceb60b7e1a691

  • SHA512

    6f67d86d4edb2ca0a31b2f206de7d1f6783124f30fedd527a2edf25efe6d885a5e64c8981dfbb91ab75dfa7213bc91465884ffb56747bb373911311c1c66f57d

Score
10/10
mespinozaransomwarespywarestealer

Malware Config

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b4b233e87c61c8698e086b376da640c9ab2ecd71c58b1f6a2eceb60b7e1a691.exe
    "C:\Users\Admin\AppData\Local\Temp\8b4b233e87c61c8698e086b376da640c9ab2ecd71c58b1f6a2eceb60b7e1a691.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2848
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
        PID:1756
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 0
      1⤵
      • Checks processor information in registry
      PID:1948

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\USOShared\Logs\User\NotifyIcon.82ae91be-05cc-4ef7-85a5-a37b05d9acb3.1.etl
      MD5

      d329a41d9a60032d527e403b9a332d27

      SHA1

      732789542c3e81fe253f81848e9ade4058d777dc

      SHA256

      32d47f748763583af34093479f8e188ad8942a1571c86b42e11012d505caf282

      SHA512

      c298b33b4e3f070c6a19fe15d633384ee6b73f2e3b13024f3527a364be768d1218c680bbfbab89b23afef6226342847d6c2756579df8f925e44f033922cf249d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\update.bat
      MD5

      328e5a4ddab70e2acca55d330c1dfce8

      SHA1

      944ef0483c863aa6804635d248e2a80d0a7d0bf4

      SHA256

      f32bfb8ae65d9b88519d86750a192cae83de68cbb5dcc5a1d788cb1390ae0845

      SHA512

      6f1e75b34488a870751ebda52638c98b7ae3a0d55f3a9ededa96702e06da3448eaf3cfe074b093e678cb45379253222c1ed954012f0e62a067763a5f51ab2706

      Download Submit