Resubmissions

12-06-2022 22:27

220612-2c3s6adgd5 10

10-06-2022 17:29

220610-v2jm9adfel 8

Analysis

  • max time kernel
    114s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    10-06-2022 17:29

General

  • Target

    State-Farm-Auto-Insurance-Policy-Booklet.exe

  • Size

    266.0MB

  • MD5

    3a015f8d7013c0fef3322e08cd41b565

  • SHA1

    b4d03c21ff99aceb0023ec581e953b17ad541580

  • SHA256

    29014a3438c174c2e7377168adf62080e7566e1664c1b639e454a9ad961b5fde

  • SHA512

    f97e2b80eb0b00351c406df2a455d3dfe214925aada81455c5d40924a613ef883119a365978b50882a35fb27635c5937af0da7a8a5f91074eefa6eaba10518bf

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 7 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe
    "C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\Plevin.exe
      "C:\Users\Admin\AppData\Local\Temp\Plevin.exe"
      2⤵
      • Executes dropped EXE
      PID:1616
    • C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe
      "C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe" /s
      2⤵
      • Drops startup file
      • Modifies registry class
      PID:1360

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Plevin.exe

    Filesize

    997KB

    MD5

    dbc534854dd385e59a3f1906ddfb9020

    SHA1

    2b3062d82232ce10a8713829199769ff0d12e0fc

    SHA256

    06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

    SHA512

    1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

  • memory/1360-63-0x0000000002120000-0x00000000021C6000-memory.dmp

    Filesize

    664KB

  • memory/1360-58-0x0000000000000000-mapping.dmp

  • memory/1360-59-0x000000001B920000-0x000000001BC02000-memory.dmp

    Filesize

    2.9MB

  • memory/1360-60-0x00000000003D0000-0x00000000003EC000-memory.dmp

    Filesize

    112KB

  • memory/1360-61-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/1360-62-0x00000000001D0000-0x00000000001D8000-memory.dmp

    Filesize

    32KB

  • memory/1360-64-0x00000000009F0000-0x0000000000A24000-memory.dmp

    Filesize

    208KB

  • memory/1360-65-0x0000000000A30000-0x0000000000A7A000-memory.dmp

    Filesize

    296KB

  • memory/1360-66-0x0000000000530000-0x0000000000546000-memory.dmp

    Filesize

    88KB

  • memory/1616-55-0x0000000000000000-mapping.dmp

  • memory/1616-57-0x0000000075191000-0x0000000075193000-memory.dmp

    Filesize

    8KB

  • memory/2016-54-0x0000000000A80000-0x0000000000D14000-memory.dmp

    Filesize

    2.6MB