f1c65a4c95ac59ee5774fd858b8e4cb9cdd3d1374894c33eabeef692f76f889e

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
21/04/2022, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
request no 21.exe
Size 529KB
Sample220421-ntz7psebf9
SHA256 f1c65a4c95ac59ee5774fd858b8e4cb9cdd3d1374894c33eabeef692f76f889e
MD5 062e8032f49e8a6cee590a6ffd5767e4
SHA1 4290bf45833c71247f4ec75fa06aaf4839c18fc9
SHA512 c5be6932592b12209c33d27830c77c470d49d9c704478a86d99d8640ca212cf6ba68a89d7ddd7b3fca46df58eecc92cca0e396406a3c67b9813cf25bf2253fe0
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1964	bbbcvmvg.exe
952	bbbcvmvg.exe

Loads dropped DLL 3 IoCs

pid	Process
2008	request no 21.exe
2008	request no 21.exe
1964	bbbcvmvg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 952	1964	bbbcvmvg.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
952	bbbcvmvg.exe
952	bbbcvmvg.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1964	2008	request no 21.exe	27
PID 2008 wrote to memory of 1964	2008	request no 21.exe	27
PID 2008 wrote to memory of 1964	2008	request no 21.exe	27
PID 2008 wrote to memory of 1964	2008	request no 21.exe	27
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28
PID 1964 wrote to memory of 952	1964	bbbcvmvg.exe	28

C:\Users\Admin\AppData\Local\Temp\request no 21.exe
"C:\Users\Admin\AppData\Local\Temp\request no 21.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
  C:\Users\Admin\AppData\Local\Temp\bbbcvmvg.exe C:\Users\Admin\AppData\Local\Temp\emlnnyk
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
    C:\Users\Admin\AppData\Local\Temp\bbbcvmvg.exe C:\Users\Admin\AppData\Local\Temp\emlnnyk
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

acgi2ze9w22zwpd1

Path C:\Users\Admin\AppData\Local\Temp\acgi2ze9w22zwpd1
Size 459KB
SHA256 72fc01beec75d3c81db43366589eb2e34ef6f09d7178e0dcf47d974a12c4eab9
MD5 b938d64999f47354efd30dba5a179d6b
SHA1 2a9d4b7239ec725bd71fe4cc87f34d0cfc20eb58
SHA512 4bc35a4c2466368db30777dcecb3db0a3e658ab255de4b9afcfb9efbe3e33b9369be40e838e045f8ae3698a8caafb3d5637da6b95db06b3e0417fb5562849935
SSDEEP 6144:n0DLXl4JJdW7fsRAUgCZ6AhyOOBA+da9fTh2PpMvPztabqiVmMKgzjS:noblNfsSkpHflopMvPzeqGmeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbbcvmvg.exe

Path C:\Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
Size 64KB
SHA256 64dd33e9f84d889170d2b69e1d620963246f97ef8f9f08930c87b66808d50441
MD5 59a249f85618f8ad69c38b47461e6d89
SHA1 3e0d6cc0e61fc678695834635d1ec36d5df18846
SHA512 148d261e6e0eec4eacc1a6e1895183d1ad42ff734e79c1ed4c46029a5545505446a591e898b7496d1ad02bff152db8f9fce80b23f66e0606035cf42ec272d9c4
SSDEEP 768:RQIWvdoo83wWWx3qxkweb61rfXnuvkn0ju8bawiBINKtc8WhsWjcdxv8vjC+9Vv:VWt5qm7baXwkwe5c8EsWjcdkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbbcvmvg.exe

Path C:\Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
Size 64KB
SHA256 64dd33e9f84d889170d2b69e1d620963246f97ef8f9f08930c87b66808d50441
MD5 59a249f85618f8ad69c38b47461e6d89
SHA1 3e0d6cc0e61fc678695834635d1ec36d5df18846
SHA512 148d261e6e0eec4eacc1a6e1895183d1ad42ff734e79c1ed4c46029a5545505446a591e898b7496d1ad02bff152db8f9fce80b23f66e0606035cf42ec272d9c4
SSDEEP 768:RQIWvdoo83wWWx3qxkweb61rfXnuvkn0ju8bawiBINKtc8WhsWjcdxv8vjC+9Vv:VWt5qm7baXwkwe5c8EsWjcdkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbbcvmvg.exe

Path C:\Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
Size 64KB
SHA256 64dd33e9f84d889170d2b69e1d620963246f97ef8f9f08930c87b66808d50441
MD5 59a249f85618f8ad69c38b47461e6d89
SHA1 3e0d6cc0e61fc678695834635d1ec36d5df18846
SHA512 148d261e6e0eec4eacc1a6e1895183d1ad42ff734e79c1ed4c46029a5545505446a591e898b7496d1ad02bff152db8f9fce80b23f66e0606035cf42ec272d9c4
SSDEEP 768:RQIWvdoo83wWWx3qxkweb61rfXnuvkn0ju8bawiBINKtc8WhsWjcdxv8vjC+9Vv:VWt5qm7baXwkwe5c8EsWjcdkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

emlnnyk

Path C:\Users\Admin\AppData\Local\Temp\emlnnyk
Size 4KB
SHA256 192208813e03c57d9b27f25ae81f180955eed122652da49c8af7116034ac76d5
MD5 c4229d057514b1ec7d2cb63be6a33526
SHA1 b219c82080c388ebd6584b8b762ff13d3fb2eaf0
SHA512 93448436c4f94a9b92c570369b9c1ad9b8663500436acefbe6497c0657ce142e7b91c7a69beab82ae79525db35405d42b4c254dcc2240c417e9cd28b74c094ce
SSDEEP 96:t/jeyv3J3a+K0QzZ9do5MxMm3IgylsRZhtj1h4Fe9AHvZA8hKbSoiAiXQLQrrT99:t/RJ3aiQz1oKxMmOuRZhtj1h4Fe9AHvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbbcvmvg.exe

Path \Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
Size 64KB
SHA256 64dd33e9f84d889170d2b69e1d620963246f97ef8f9f08930c87b66808d50441
MD5 59a249f85618f8ad69c38b47461e6d89
SHA1 3e0d6cc0e61fc678695834635d1ec36d5df18846
SHA512 148d261e6e0eec4eacc1a6e1895183d1ad42ff734e79c1ed4c46029a5545505446a591e898b7496d1ad02bff152db8f9fce80b23f66e0606035cf42ec272d9c4
SSDEEP 768:RQIWvdoo83wWWx3qxkweb61rfXnuvkn0ju8bawiBINKtc8WhsWjcdxv8vjC+9Vv:VWt5qm7baXwkwe5c8EsWjcdkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbbcvmvg.exe

Path \Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
Size 64KB
SHA256 64dd33e9f84d889170d2b69e1d620963246f97ef8f9f08930c87b66808d50441
MD5 59a249f85618f8ad69c38b47461e6d89
SHA1 3e0d6cc0e61fc678695834635d1ec36d5df18846
SHA512 148d261e6e0eec4eacc1a6e1895183d1ad42ff734e79c1ed4c46029a5545505446a591e898b7496d1ad02bff152db8f9fce80b23f66e0606035cf42ec272d9c4
SSDEEP 768:RQIWvdoo83wWWx3qxkweb61rfXnuvkn0ju8bawiBINKtc8WhsWjcdxv8vjC+9Vv:VWt5qm7baXwkwe5c8EsWjcdkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbbcvmvg.exe

Path \Users\Admin\AppData\Local\Temp\bbbcvmvg.exe
Size 64KB
SHA256 64dd33e9f84d889170d2b69e1d620963246f97ef8f9f08930c87b66808d50441
MD5 59a249f85618f8ad69c38b47461e6d89
SHA1 3e0d6cc0e61fc678695834635d1ec36d5df18846
SHA512 148d261e6e0eec4eacc1a6e1895183d1ad42ff734e79c1ed4c46029a5545505446a591e898b7496d1ad02bff152db8f9fce80b23f66e0606035cf42ec272d9c4
SSDEEP 768:RQIWvdoo83wWWx3qxkweb61rfXnuvkn0ju8bawiBINKtc8WhsWjcdxv8vjC+9Vv:VWt5qm7baXwkwe5c8EsWjcdkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/952-63-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/952-71-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-54-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads