cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe
Size

722KB
MD5

a1329e138d02a4043ffbab3fc6c6a2b0
SHA1

19451a72e6cde7f3a95d4c8205e14ea836f7be49
SHA256

cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e
SHA512

7eb8c1a69990186e91d10b4ebe898c5b46bd535b7daf483a8f16baabeca067a1aa905b7f7b803dd65f9c184a010681c60e162913b9df9ebc46a61df67e0c26ac
SSDEEP

12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D02tESgDAHJkgKKyHEJ0bXPxx5:P1/aGLDCM4D8ayGMTd0pVNykJ0bXPxx5

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2192	vspgbb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\vspgbb.exe"	vspgbb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 2192	4872	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe	81
PID 4872 wrote to memory of 2192	4872	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe	81
PID 4872 wrote to memory of 2192	4872	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe	81

C:\Users\Admin\AppData\Local\Temp\cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe
"C:\Users\Admin\AppData\Local\Temp\cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\ProgramData\vspgbb.exe
  "C:\ProgramData\vspgbb.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Saaaalamm\Mira.h

Filesize
236KB

MD5
503e83ce79b4a79ef6cce1f4053fe360

SHA1
46a0c4dc368101a4c02760524dd68de1233804dc

SHA256
5127a340d6f41fe5a18c1b81bb5fec319108f996fa9c2236edf32d03aca2244a

SHA512
2991e5f9badbed80232370553a2899f8f897fdeab0ae77b8e0a2ddca9d5eb7d1b6314def0c1db91a619ed6cff9517f571c6f5f6da7751158d3dfa3b940062bed

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
268KB

MD5
15cccb964efeeb58f9cd8ebf5757b3a1

SHA1
cda2c453e19b020166b7a89d4389d33300a7febb

SHA256
4dbb6abdd207bfb4d794a8305d28e352deb8281efe70e4365d05263f80c395a7

SHA512
b933d0a0ca1ea341d0ef24903b68f09115859515b1949be109f05b414a2656e16bba686edac405fc9174ddbbf0942abf8042707b82a7382782ca3b838f8628fa

Download Submit
C:\ProgramData\vspgbb.exe

Filesize
454KB

MD5
de4b81491d5ba7e89509223690329dc6

SHA1
e41fe9b45d7859c8b1867100884bc322d6bf9ac4

SHA256
c4bce6b0bf060138d4161be6e0e7c8414e04838e73d07929a1c12ade3b2f521f

SHA512
ade0e4c0b407f89f1190abb470f551894c3b1c0b3c053456188b28e1a708175a9d9fc67852d5155d7c40f6135a280992d36230623eaf6a459f07ded4d20999d7

Download Submit
C:\ProgramData\vspgbb.exe

Filesize
454KB

MD5
de4b81491d5ba7e89509223690329dc6

SHA1
e41fe9b45d7859c8b1867100884bc322d6bf9ac4

SHA256
c4bce6b0bf060138d4161be6e0e7c8414e04838e73d07929a1c12ade3b2f521f

SHA512
ade0e4c0b407f89f1190abb470f551894c3b1c0b3c053456188b28e1a708175a9d9fc67852d5155d7c40f6135a280992d36230623eaf6a459f07ded4d20999d7

Download Submit