9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe
Size

9.2MB
MD5

56c66acb8eb7358c36fdcbe288100a04
SHA1

db93fce96d56b41c5c84d712bf23994fac8c8b08
SHA256

9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d
SHA512

3c54ed2523bda1610355c414c2583679adf13df244052ad3c7e854fcb274ebe4de8fb780d1b460a843e396df9daa42bb4710c0df8e1fd1fbd504fd5682d09ba3
SSDEEP

196608:3VUnZo0N21K/C6uXJlv1ulcdqg/7/OdLPeXAECGwXAAJbTAFj0jNy4:lUnZtN21K/C6uXJlv1ulCqg/LOdPksGy

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 4580	2276	9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4580	2276	9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe	80
PID 2276 wrote to memory of 4580	2276	9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe	80
PID 2276 wrote to memory of 4580	2276	9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe	80
PID 2276 wrote to memory of 4580	2276	9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe	80
PID 2276 wrote to memory of 4580	2276	9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe	80

C:\Users\Admin\AppData\Local\Temp\9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe
"C:\Users\Admin\AppData\Local\Temp\9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe
  "C:\Users\Admin\AppData\Local\Temp\9f40575827b60cb4f2251567a5cb0a089a2181753331c36e55bb7cfc98d5d32d.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4580-133-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/4580-134-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/4580-135-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/4580-136-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/4580-137-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download