cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe
Size

96KB
MD5

c5124745509b1aa9f5960bc823af1516
SHA1

221ec69c887168b5281e26be502f5236526707ce
SHA256

cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b
SHA512

ffb53b153649dcab94a67350439df2a70fc336cdecd8c79991fa69c127ac79950dc3b071280e683b031af3caf726e67860139a10124e748e4e79113449467cad
SSDEEP

1536:/epdA4uOp3ud2sUNxbaTjJ0wwG13YsxWXvHZ62a8rJ3XF:UQE9xWHJ4UIsxev56wJ3

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
980	ACB.tmp

Loads dropped DLL 2 IoCs

pid	Process
2024	cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe
2024	cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ACB.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ACB.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ACB.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
980	ACB.tmp
2024	cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 980	2024	cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe	27
PID 2024 wrote to memory of 980	2024	cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe	27
PID 2024 wrote to memory of 980	2024	cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe	27
PID 2024 wrote to memory of 980	2024	cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe	27

C:\Users\Admin\AppData\Local\Temp\cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe
"C:\Users\Admin\AppData\Local\Temp\cabf260adb91b82d6b5459654f3a43a0db020d00cc113f0b7779b96f18a3152b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\ACB.tmp
  C:\Users\Admin\AppData\Local\Temp\ACB.tmp
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ACB.tmp

Filesize
76KB

MD5
e00cdf4335fb098346b0aeadadf7d6a4

SHA1
586a721e0ae6fa202791d3b48daa1749548b80ed

SHA256
414e3d2fa10f6c6c457bc0f1daed22cdd43d56e7407d876508cef81e8baa878d

SHA512
88f778ca02a2e4ecc706fb2987762a56832fc8f23dd92e1874718d742a11c400194dbb24c7dfe47525ec608c7957708d39125b7222e7bfc70a2d862c30f2ab3d

Download Submit
\Users\Admin\AppData\Local\Temp\ACB.tmp

Filesize
76KB

MD5
e00cdf4335fb098346b0aeadadf7d6a4

SHA1
586a721e0ae6fa202791d3b48daa1749548b80ed

SHA256
414e3d2fa10f6c6c457bc0f1daed22cdd43d56e7407d876508cef81e8baa878d

SHA512
88f778ca02a2e4ecc706fb2987762a56832fc8f23dd92e1874718d742a11c400194dbb24c7dfe47525ec608c7957708d39125b7222e7bfc70a2d862c30f2ab3d

Download Submit
\Users\Admin\AppData\Local\Temp\ACB.tmp

Filesize
76KB

MD5
e00cdf4335fb098346b0aeadadf7d6a4

SHA1
586a721e0ae6fa202791d3b48daa1749548b80ed

SHA256
414e3d2fa10f6c6c457bc0f1daed22cdd43d56e7407d876508cef81e8baa878d

SHA512
88f778ca02a2e4ecc706fb2987762a56832fc8f23dd92e1874718d742a11c400194dbb24c7dfe47525ec608c7957708d39125b7222e7bfc70a2d862c30f2ab3d

Download Submit
memory/980-56-0x0000000000000000-mapping.dmp

Download
memory/980-61-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2024-63-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download