03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39.exe
Size

410KB
MD5

6eaaa5ec2b3b5568cdeadf039433b972
SHA1

640500d56a0fa9a6a11e54d22217826671668146
SHA256

03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39
SHA512

b16bd7fda52181ae576172f912c3e9d6a8478fa79617cd0ab4a00dac4a5763f652c5f33e8677d5a6bd5aa2194cb71537356eecdb7b25906e5e14bad539042e97
SSDEEP

12288:CxIK9V14ImyHYxB96NNlUKbMCA41s46zArSIWczi39XoMygkJfZyk:CJEyY96NNlUKbjp1PrSIWczi39XoMygW

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4776	ghnfs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\ghnfs.exe"	ghnfs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4776	864	03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39.exe	87
PID 864 wrote to memory of 4776	864	03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39.exe	87
PID 864 wrote to memory of 4776	864	03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39.exe	87

C:\Users\Admin\AppData\Local\Temp\03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39.exe
"C:\Users\Admin\AppData\Local\Temp\03f1403f783e23534ed09990bd735a927e7d54c4d7fc7a7aceb0004e947edf39.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\ProgramData\ghnfs.exe
  "C:\ProgramData\ghnfs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Saaaalamm\Mira.h

Filesize
150KB

MD5
a52d6cb53c4c31e9f5ad53a356adf9dd

SHA1
4e9b2d208dc3c3a6e23decb0a7d7381c73f7b101

SHA256
f6bc441488529eadccfef115d11fa10c5cb8cb125b6c08c52a2bbc144bd4f7d8

SHA512
6d86153ffb8c803092d4fe30f1df1371657023eb10fd56dfeca684ff13a3222f64b11592576d3990f14cf915987a3372cf89774f811ef33dbd5f1b7db5ba681b

Download Submit
C:\ProgramData\ghnfs.exe

Filesize
260KB

MD5
5ff19107eb384d70fabd115aa7bb5316

SHA1
10c5f3560872784d51a8fbcfb461e4f375c5eca4

SHA256
b353adf9d81f8b1c9eb7aa218c98c7fefa0023b5cb069868ef2573a39cade7c8

SHA512
12076434ef6bbab4e27fb1b3f797cf0ab65c8aa36897d6622a5a9a7ca19c48af885955d1218f3439f9a2842fa71b702035af98455a176dfa662f16aa6d572735

Download Submit
C:\ProgramData\ghnfs.exe

Filesize
260KB

MD5
5ff19107eb384d70fabd115aa7bb5316

SHA1
10c5f3560872784d51a8fbcfb461e4f375c5eca4

SHA256
b353adf9d81f8b1c9eb7aa218c98c7fefa0023b5cb069868ef2573a39cade7c8

SHA512
12076434ef6bbab4e27fb1b3f797cf0ab65c8aa36897d6622a5a9a7ca19c48af885955d1218f3439f9a2842fa71b702035af98455a176dfa662f16aa6d572735

Download Submit
memory/864-132-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/864-133-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/864-137-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download