0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951

Analysis

max time kernel
179s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 21:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe
Size

1.4MB
MD5

68abe0cf3dd2357bb41855ef72827f8f
SHA1

152e45c14dd23aa1392e2fef5255ca127ed6ba43
SHA256

0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951
SHA512

b3bb9d6d10dd5a944c9681a1bb169980575d3acf3eb13456bd8fd242b45eb2b502dac1f77de7178fcfecdfb04d621538462617c92f669ac6a905f3e214959059
SSDEEP

24576:Di2Dv7gosohG20JaB7SNWa6StffOSqICV+GKTMiaIH1qMQhex:2Cb9SL60ql+3H8hy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1748	search.cmd

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe

Loads dropped DLL 2 IoCs

pid	Process
1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe
1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1748	search.cmd

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1748	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	27
PID 1600 wrote to memory of 1748	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	27
PID 1600 wrote to memory of 1748	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	27
PID 1600 wrote to memory of 1748	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	27
PID 1600 wrote to memory of 2044	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	28
PID 1600 wrote to memory of 2044	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	28
PID 1600 wrote to memory of 2044	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	28
PID 1600 wrote to memory of 2044	1600	0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe	28

C:\Users\Admin\AppData\Local\Temp\0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe
"C:\Users\Admin\AppData\Local\Temp\0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del c:\users\admin\appdata\local\temp\0184A3~1.EXE >> NUL
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
68abe0cf3dd2357bb41855ef72827f8f

SHA1
152e45c14dd23aa1392e2fef5255ca127ed6ba43

SHA256
0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951

SHA512
b3bb9d6d10dd5a944c9681a1bb169980575d3acf3eb13456bd8fd242b45eb2b502dac1f77de7178fcfecdfb04d621538462617c92f669ac6a905f3e214959059

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
68abe0cf3dd2357bb41855ef72827f8f

SHA1
152e45c14dd23aa1392e2fef5255ca127ed6ba43

SHA256
0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951

SHA512
b3bb9d6d10dd5a944c9681a1bb169980575d3acf3eb13456bd8fd242b45eb2b502dac1f77de7178fcfecdfb04d621538462617c92f669ac6a905f3e214959059

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
68abe0cf3dd2357bb41855ef72827f8f

SHA1
152e45c14dd23aa1392e2fef5255ca127ed6ba43

SHA256
0184a3377d4b435389ca08ccacea7570eda0b73ba79103c3aaee926c9065b951

SHA512
b3bb9d6d10dd5a944c9681a1bb169980575d3acf3eb13456bd8fd242b45eb2b502dac1f77de7178fcfecdfb04d621538462617c92f669ac6a905f3e214959059

Download Submit
memory/1600-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1600-62-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1748-63-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download