3a2720b1b2f8615c9ac2b2e95c0bd94728bbafd653b6dc86454aa083066f954f

Analysis

max time kernel
42s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
20/05/2022, 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KUMATUBES_Challan.exe
Size

632KB
MD5

6987b895ed60ef35439c4acdbc2493e4
SHA1

a73ed9c7c97404d04c2a63ca5a5c0f193598c1c1
SHA256

2bd4a68bf90d7d007980c8c9a6ca3859507d6f8ad00c4d53b859ffe9e7311751
SHA512

a38a8296a1017b74df57d3bb0bce5e3866bb3b9374362477f0d4af58ba11e18c33d70dbd1b5c56aac0ed9a5202918cc4efb62ebacca6f34f27416cb81a88ae64

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1408	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
556	KUMATUBES_Challan.exe
556	KUMATUBES_Challan.exe
556	KUMATUBES_Challan.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1604	556	KUMATUBES_Challan.exe	29
PID 556 wrote to memory of 1604	556	KUMATUBES_Challan.exe	29
PID 556 wrote to memory of 1604	556	KUMATUBES_Challan.exe	29
PID 556 wrote to memory of 1604	556	KUMATUBES_Challan.exe	29

C:\Users\Admin\AppData\Local\Temp\KUMATUBES_Challan.exe
"C:\Users\Admin\AppData\Local\Temp\KUMATUBES_Challan.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\RECEIPT.bmp
  2⤵
  PID:1604

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-56-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download