bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2022 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4.exe
Size

4.2MB
MD5

6bb93c6d326587b5ebe0c379af6d13f3
SHA1

d28f45d077a927b854f1d3772ed3af9854022365
SHA256

bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4
SHA512

eae302343cd00e50677277d160f5b86a8ac096c428791fa970b14d5622b05394bc0691d85ed0e3f76a7b5620459a951366a8571c83e16db0be2897d4f2f416dd
SSDEEP

98304:fbZEvgC7LsdDS+76umcnxk2w2DJoLo/r2:lEvd7LsdDS+wjD08Oy

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1416	bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4.exe

C:\Users\Admin\AppData\Local\Temp\bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4.exe
"C:\Users\Admin\AppData\Local\Temp\bbc164be644fa50cc91ec3dcc9bc47151dd0414e19293f9d7e83fd82e63d5de4.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-132-0x0000000000400000-0x0000000000C7F000-memory.dmp

Filesize
8.5MB

Download
memory/1416-133-0x0000000002BF0000-0x0000000002BF3000-memory.dmp

Filesize
12KB

Download
memory/1416-135-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-136-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-134-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-137-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-138-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-139-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-140-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-142-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-141-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-144-0x0000000002D20000-0x0000000002E60000-memory.dmp

Filesize
1.2MB

Download
memory/1416-145-0x0000000000400000-0x0000000000C7F000-memory.dmp

Filesize
8.5MB

Download