2441ed8ca3e299e43eb72b656235a0fc11bb9579f68b1af48cbcab6b7017bf59

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
31/03/2022, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c0344ca829912702b31843db792cf68.exe
Size 233KB
Sample220331-k816rshef7
SHA256 2441ed8ca3e299e43eb72b656235a0fc11bb9579f68b1af48cbcab6b7017bf59
MD5 2c0344ca829912702b31843db792cf68
SHA1 1138c86774780173801fecda1717e1952d63b82d
SHA512 385c9d1da3ba0af20d6bd2b8578a01006948fb1be13dd66ca94ec29a74239a81bde8a70ccb15de70a2e070978f4237c7e802761cb38bbd02cfac82e3db70388e
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4596	zstcuzke.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4596	700	2c0344ca829912702b31843db792cf68.exe	83
PID 700 wrote to memory of 4596	700	2c0344ca829912702b31843db792cf68.exe	83
PID 700 wrote to memory of 4596	700	2c0344ca829912702b31843db792cf68.exe	83
PID 4596 wrote to memory of 4692	4596	zstcuzke.exe	84
PID 4596 wrote to memory of 4692	4596	zstcuzke.exe	84
PID 4596 wrote to memory of 4692	4596	zstcuzke.exe	84

C:\Users\Admin\AppData\Local\Temp\2c0344ca829912702b31843db792cf68.exe
"C:\Users\Admin\AppData\Local\Temp\2c0344ca829912702b31843db792cf68.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Local\Temp\zstcuzke.exe
  C:\Users\Admin\AppData\Local\Temp\zstcuzke.exe C:\Users\Admin\AppData\Local\Temp\beqnsw
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\zstcuzke.exe
    C:\Users\Admin\AppData\Local\Temp\zstcuzke.exe C:\Users\Admin\AppData\Local\Temp\beqnsw
    3⤵
    PID:4692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

beqnsw

Path C:\Users\Admin\AppData\Local\Temp\beqnsw
Size 5KB
SHA256 b804b36a7169e29d70364e1ea4fda3b2464828feebbbf055f074ae92b8bc65ee
MD5 1c5ea1ce518081f4060f650c927569d4
SHA1 5d184e0845dfce7373cf1e65446bd5fc741f6034
SHA512 8a9e49e1e8ab92785f7268b21843790cc617f0d21be806b06e08a5893843a839c0e0a390b52b30ac530a7c4c6183e2a313e4c5dead238b6872719d61ce36e0a5
MD5 SHA1 SHA512

Submit Download

j1811g9zetx5q98oe

Path C:\Users\Admin\AppData\Local\Temp\j1811g9zetx5q98oe
Size 212KB
SHA256 b6fc4ec8eb5ba55979a215f4809260b256d2dcfbf2e8625624b5ee2a2f7cd441
MD5 cfb7c18543b3904bbef1209ea2e76932
SHA1 d0f31392c89816970b8b160a4cc3ef5eb912fa5e
SHA512 75c719ff5bbc10cc12bffa1fa2d2c822513ec850b90ee86c80d3f61c2514786adf5bc6246c76839819e7e01bdb1d37a5c66875b22dbbb673d339a8180f61b314
MD5 SHA1 SHA512

Submit Download

zstcuzke.exe

Path C:\Users\Admin\AppData\Local\Temp\zstcuzke.exe
Size 5KB
SHA256 7ea35c0e250281ccde55db17b2889a42f8355abdb881392f9e5a51d1418d8bb4
MD5 09d2452460293ab13dea9b09f64ac5c2
SHA1 3ca2f6c55f26034cc80861523d40b4e3fb885974
SHA512 e8047d73383e9d6a7183db372fbf22391e171f023a5094bf9b575cfc347a87545a8a0d87fbba79c187294e0269e98f5ceeeb5ac0448640500ff65b018699dd10
MD5 SHA1 SHA512

Submit Download

zstcuzke.exe

Path C:\Users\Admin\AppData\Local\Temp\zstcuzke.exe
Size 5KB
SHA256 7ea35c0e250281ccde55db17b2889a42f8355abdb881392f9e5a51d1418d8bb4
MD5 09d2452460293ab13dea9b09f64ac5c2
SHA1 3ca2f6c55f26034cc80861523d40b4e3fb885974
SHA512 e8047d73383e9d6a7183db372fbf22391e171f023a5094bf9b575cfc347a87545a8a0d87fbba79c187294e0269e98f5ceeeb5ac0448640500ff65b018699dd10
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads