788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb.exe
Size

644KB
MD5

c670c760469c6790837e2dfbb65dba3c
SHA1

744f3d152fd741324f3d1db9a59e7b4bc2816b91
SHA256

788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb
SHA512

1baa805d531bcac605448dc026dc5e47ac7fadb966544a20a2536d859abdd1ed1df32846b5e81d3dc5873e66f0d13a44f291a669702696a4809baa8eefa77cc9
SSDEEP

12288:EaWzgMg7v3qnCiMErQohh0F4CCJ8lnyPQZJO:baHMv6CorjqnyPQZJO

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4720	AntiR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 4720	3916	788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb.exe	79
PID 3916 wrote to memory of 4720	3916	788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb.exe	79
PID 3916 wrote to memory of 4720	3916	788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb.exe	79
PID 4720 wrote to memory of 2584	4720	AntiR.exe	80
PID 4720 wrote to memory of 2584	4720	AntiR.exe	80

C:\Users\Admin\AppData\Local\Temp\788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb.exe
"C:\Users\Admin\AppData\Local\Temp\788d382725cb751d6fa2c967fb627e3caa792090c9289647ee990e3643eb7efb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\新建文件夹\AntiR.exe
  "C:\Users\Admin\AppData\Local\Temp\新建文件夹\AntiR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0SYM3PLV.bat" "C:\Users\Admin\AppData\Local\Temp\?????\AntiR.exe""
    3⤵
    PID:2584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0SYM3PLV.bat

Filesize
118B

MD5
b5b584dbe1f268d486938893130803a9

SHA1
e3fa66e1d281908f42dbcd76a31cca94b18ff852

SHA256
687e174f891965b9ae1648651fe7d7bf9da40e62bb7c5a412046572eb10a879d

SHA512
cc34bdd3dbac05c3516cbd278a0bc3236daba7843580ed3cc3d1f3ac70d725b0ad29d761589aabdfdce09ab62edbd27330d6ddfc394f2013500eeb1f3ac0ac6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\新建文件夹\AntiR.exe

Filesize
27KB

MD5
39042a08dc702429c40538e666d264a6

SHA1
ce0e561d50938cee4c5d57d9a53f0cc1c8029a58

SHA256
67cde9290220cf59e1bf022b6d52647552192237968e13bd11ab44b2d2f20f38

SHA512
09bc8480b7ca56e51800a49af98a0bbd9715e811510759e6aee5b61d9dc2caa6bd1447e8d498e5099c40e235be4e845b42ee12dc15656bf6ce5505a840fdee0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\新建文件夹\AntiR.exe

Filesize
27KB

MD5
39042a08dc702429c40538e666d264a6

SHA1
ce0e561d50938cee4c5d57d9a53f0cc1c8029a58

SHA256
67cde9290220cf59e1bf022b6d52647552192237968e13bd11ab44b2d2f20f38

SHA512
09bc8480b7ca56e51800a49af98a0bbd9715e811510759e6aee5b61d9dc2caa6bd1447e8d498e5099c40e235be4e845b42ee12dc15656bf6ce5505a840fdee0f

Download Submit