Analysis
-
max time kernel
300s -
max time network
308s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
21-09-2022 04:05
General
-
Target
46052db60a2b08b55f05034b7b9d9635349119fe3d70f6fe7b8eb23611b97708.exe
-
Size
294KB
-
MD5
ce622d13f25096c53cdac31825060162
-
SHA1
badade418fc6c9029b630e999f9c0ddfef16641e
-
SHA256
46052db60a2b08b55f05034b7b9d9635349119fe3d70f6fe7b8eb23611b97708
-
SHA512
3b321544c3076aa64579d9588f93a4affaa9f74d2ca386b66ad664384e5670391aaab0877b6f5639e43778908a62152b67d5b9ab3b0481615d27e59b2926ac20
-
SSDEEP
6144:PIIcrXQ4S33w614mazUBHfSdocWYD24IT+tcWnE:JcrNS33L10QdrXZT+tcWnE
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46052db60a2b08b55f05034b7b9d9635349119fe3d70f6fe7b8eb23611b97708.exe"C:\Users\Admin\AppData\Local\Temp\46052db60a2b08b55f05034b7b9d9635349119fe3d70f6fe7b8eb23611b97708.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\s.vbs"2⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD58b47303c62dfc2b13ebd535577c414ee
SHA15213d13045bafcc66dda4546eccca53ee9ba8bf6
SHA2561690747279413de5e28454fd111bd05d3821b448c2affa4b560dec3ad1d96ba5
SHA5126191a60f57a1c2f8afbfec560e0d4a1063116787ad261c584323e910d35ccab3b6bc0bdf9fcb1ee25b8de084f709a46ed41671a34787ae64d7f15df231274012
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB