01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947

Analysis

max time kernel
111s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
Size

872KB
MD5

6b779c2adc5451a0a2c1369054e011a3
SHA1

9f63e8e6de26af8cc303e818845b5a30f592ef1b
SHA256

01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947
SHA512

452c83287cb52267117b99b47b5870f6c2b039c69d7556d6afa8c8dec0f83202ad8a8a305095bfa9c75738beddef4f37c5916dd7a8d1901d2c752e20f6a5ce5c
SSDEEP

24576:uRmJkcoQricOIQxiZY1iaC/TKwVqSP5nS:7JZoQrbTFZY1iaCLPV3c

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80
PID 1312 wrote to memory of 532	1312	01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe	80

C:\Users\Admin\AppData\Local\Temp\01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
"C:\Users\Admin\AppData\Local\Temp\01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe
  "C:\Users\Admin\AppData\Local\Temp\01b1fa3320b5035c4e81734bc4bc8d1b184827c55033521bd1b622f2d119a947.exe"
  2⤵
  PID:532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/532-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download