b41af70143e5844a758bb9c4cce57014170e2ebe169e684b6af127f6c3cece83

Analysis

max time kernel
4294183s
max time network
132s
platform
windows7_x64
resource
win7-20220311-en
submitted
24/03/2022, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
212e7e952a63c98821e2ec9f84d52c23.exe
Size 298KB
Sample220324-xyvmfsdcf4
SHA256 b41af70143e5844a758bb9c4cce57014170e2ebe169e684b6af127f6c3cece83
MD5 212e7e952a63c98821e2ec9f84d52c23
SHA1 c3ad0c119e91f06f06cf1c12b31f8ec275639199
SHA512 b09ecdf79d13aa47be639f8bfc3a2cf9dd6f840f12bb9ee1a558da6d637e3b2cb1e696d0ecf862ff7dc5d7644796f430928ed68194353cb4dbd30707a61583b3
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2008	gfndfunqx.exe

Loads dropped DLL 3 IoCs

pid	Process
2032	212e7e952a63c98821e2ec9f84d52c23.exe
2032	212e7e952a63c98821e2ec9f84d52c23.exe
2008	gfndfunqx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2008	2032	212e7e952a63c98821e2ec9f84d52c23.exe	27
PID 2032 wrote to memory of 2008	2032	212e7e952a63c98821e2ec9f84d52c23.exe	27
PID 2032 wrote to memory of 2008	2032	212e7e952a63c98821e2ec9f84d52c23.exe	27
PID 2032 wrote to memory of 2008	2032	212e7e952a63c98821e2ec9f84d52c23.exe	27
PID 2008 wrote to memory of 272	2008	gfndfunqx.exe	28
PID 2008 wrote to memory of 272	2008	gfndfunqx.exe	28
PID 2008 wrote to memory of 272	2008	gfndfunqx.exe	28
PID 2008 wrote to memory of 272	2008	gfndfunqx.exe	28

C:\Users\Admin\AppData\Local\Temp\212e7e952a63c98821e2ec9f84d52c23.exe
"C:\Users\Admin\AppData\Local\Temp\212e7e952a63c98821e2ec9f84d52c23.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\gfndfunqx.exe
  C:\Users\Admin\AppData\Local\Temp\gfndfunqx.exe C:\Users\Admin\AppData\Local\Temp\wazop
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\gfndfunqx.exe
    C:\Users\Admin\AppData\Local\Temp\gfndfunqx.exe C:\Users\Admin\AppData\Local\Temp\wazop
    3⤵
    PID:272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-62-0x0000000000080000-0x0000000000082000-memory.dmp

Download

memory/2032-54-0x0000000075801000-0x0000000075803000-memory.dmp