b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe
Size

120KB
MD5

81b5ac4c43ede6046f63ae4e356d79f0
SHA1

531535568a34c6f213eb75413c1f5c3742e0936f
SHA256

b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3
SHA512

3ccd9bfbafed009f30894afb52687a344d710c27b81c03968046b3b30a0f60f70a0323c9c2979fd7c723fb43d6d2a2966a00892194f6b04f4666b9bfbd2d0ea7
SSDEEP

768:Hcb913EZIIyW3kcXAo9JJ1uWXGGg3gX7zvEveqQR3uoHVx4Yv:Ha13EZIvO8o9JJkiGGwgPsGqQxuMLtv

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1932	ahyguys.exe

Loads dropped DLL 2 IoCs

pid	Process
364	b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe
364	b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1932	364	b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe	27
PID 364 wrote to memory of 1932	364	b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe	27
PID 364 wrote to memory of 1932	364	b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe	27
PID 364 wrote to memory of 1932	364	b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe	27

C:\Users\Admin\AppData\Local\Temp\b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe
"C:\Users\Admin\AppData\Local\Temp\b4b0f578e14fe27aff1dc8775e4767f21f5789676ad5f198bf9e03350ac7bbf3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\ahyguys.exe
  "C:\Users\Admin\AppData\Local\Temp\ahyguys.exe"
  2⤵
  - Executes dropped EXE
  PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahyguys.exe

Filesize
120KB

MD5
0200cfa5d9d6369386fe51f8ce04b149

SHA1
6674fe14f256df41b84821791b7f6e60a0d8e199

SHA256
553405a8f1229b4dc764661f5a576167298dbe67af90a9922f861d9da97863fc

SHA512
8457729c9dbd2ad96b1292460e6802f1dd9d59076633506b2638b0eaced4998374d3625b774f26b461678d243dd16cd508b484d32a41ca4c5dc1623ddf72e566

Download Submit
C:\Users\Admin\AppData\Local\Temp\ahyguys.exe

Filesize
120KB

MD5
0200cfa5d9d6369386fe51f8ce04b149

SHA1
6674fe14f256df41b84821791b7f6e60a0d8e199

SHA256
553405a8f1229b4dc764661f5a576167298dbe67af90a9922f861d9da97863fc

SHA512
8457729c9dbd2ad96b1292460e6802f1dd9d59076633506b2638b0eaced4998374d3625b774f26b461678d243dd16cd508b484d32a41ca4c5dc1623ddf72e566

Download Submit
\Users\Admin\AppData\Local\Temp\ahyguys.exe

Filesize
120KB

MD5
0200cfa5d9d6369386fe51f8ce04b149

SHA1
6674fe14f256df41b84821791b7f6e60a0d8e199

SHA256
553405a8f1229b4dc764661f5a576167298dbe67af90a9922f861d9da97863fc

SHA512
8457729c9dbd2ad96b1292460e6802f1dd9d59076633506b2638b0eaced4998374d3625b774f26b461678d243dd16cd508b484d32a41ca4c5dc1623ddf72e566

Download Submit
\Users\Admin\AppData\Local\Temp\ahyguys.exe

Filesize
120KB

MD5
0200cfa5d9d6369386fe51f8ce04b149

SHA1
6674fe14f256df41b84821791b7f6e60a0d8e199

SHA256
553405a8f1229b4dc764661f5a576167298dbe67af90a9922f861d9da97863fc

SHA512
8457729c9dbd2ad96b1292460e6802f1dd9d59076633506b2638b0eaced4998374d3625b774f26b461678d243dd16cd508b484d32a41ca4c5dc1623ddf72e566

Download Submit
memory/364-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/364-59-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1932-62-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download