9cbde46a7df0a6e7ba3ec5099c4b4fc087d027e3016f8486ad17efe5261af8e2

Analysis

max time kernel
85s
max time network
89s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
10/08/2022, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xRPq9dE9O8Nw.exe
Size 465KB
Sample220810-yldnvaeccr
SHA256 9cbde46a7df0a6e7ba3ec5099c4b4fc087d027e3016f8486ad17efe5261af8e2
MD5 a0ac1b5c1020bf5f6c787eab8b418a30
SHA1 b7609339e58a5e329e26630fb7ebfc67ff7f7494
SHA512 aa9617a29b3e02407a10f280cfdf145f4eb04724edd53f6933038818e5e476dd11af25b9c18f813d080224e164bfe686e8ff0c8cdbc0eb7b45d576ec1b2539d1
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
764	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1660	xRPq9dE9O8Nw.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 764	1660	xRPq9dE9O8Nw.exe	29
PID 1660 wrote to memory of 764	1660	xRPq9dE9O8Nw.exe	29
PID 1660 wrote to memory of 764	1660	xRPq9dE9O8Nw.exe	29
PID 1660 wrote to memory of 764	1660	xRPq9dE9O8Nw.exe	29

C:\Users\Admin\AppData\Local\Temp\xRPq9dE9O8Nw.exe
"C:\Users\Admin\AppData\Local\Temp\xRPq9dE9O8Nw.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zavwjridbrokanurwpakfiysqidvuiocp.vbs"
  2⤵
  - Deletes itself
  PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zavwjridbrokanurwpakfiysqidvuiocp.vbs

Path C:\Users\Admin\AppData\Local\Temp\zavwjridbrokanurwpakfiysqidvuiocp.vbs
Size 520B
SHA256 708e9a3363d4e48c04af5b0369039e3487b465897dac195144664da0352b0da6
MD5 c932b8344542699ac54a09e5f15d9271
SHA1 6ea71f7f64ec891667dfc888e34a7bc8973e3dbd
SHA512 d1298033b0eb42b883da6bca577952e5da92c4fbceabebed59cb7a176e40289d4bd9f7c0888c847553bf49c3d182968b786a81705a1d1293930d67029b58f03f
MD5 SHA1 SHA512

Submit Download

memory/1660-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Download