Overview

overview

10

Static

static

10

b2qE.exe

windows7-x64

10

b2qE.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2022 16:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2qE.exe

  • Size

    17KB

  • MD5

    3efae209d698fc477f958bd0f9d0a9d3

  • SHA1

    466a722b0a262abb4f6fb08132814573cd5cdab5

  • SHA256

    dd203194d0ea8460ac3173e861737a77fa684e5334503867e91a70acc7f73195

  • SHA512

    c28bcabffb4b88c7e0f4e7a5a8da75abd8294f68ed04f67f47928608dbd9050e54591ea9f97a5a94f4076a9373792978dc09b6b10092d0d3a2093df11b612b4f

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2qE.exe
    "C:\Users\Admin\AppData\Local\Temp\b2qE.exe"
    1⤵
    • Drops startup file
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2824
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2824-130-0x00007FFAB60E0000-0x00007FFAB6B16000-memory.dmp
    Filesize

    10.2MB

    Download