b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe
Size

540KB
MD5

836889f1844bcc4b0d45c076dddc9e60
SHA1

43f5db0eec96f26fcce318bdaa387cf97e608efe
SHA256

b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a
SHA512

f5182fca19a41b66e6f39cff41ca2c2434d6f2ae6152344e1b0864b3a098a6966c602ad9e8e813bd01f88dacd63bccd1b59bd4d859934ac16c3854390e1f54e5
SSDEEP

12288:S9XdVx1+9jsFIezPTWuljbv95k92tVpg3:a/EjsFI0Fd9A2tVpo

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1980	cmd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\newiexplore.exe	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe
File created	C:\Program Files (x86)\Internet Explorer\newiexplore.exe	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\sppert.ini	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1980	1672	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe	27
PID 1672 wrote to memory of 1980	1672	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe	27
PID 1672 wrote to memory of 1980	1672	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe	27
PID 1672 wrote to memory of 1980	1672	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe	27

C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe
"C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\DelTemp.bat" "
  2⤵
  - Deletes itself
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DelTemp.bat

Filesize
187B

MD5
a937df466bb1cec01b78b85f7d750306

SHA1
a486c28051ace0e133a3210dea5de480ed931257

SHA256
cfbf50625c150e395e83ff255c37369909b9f5aadc573f7c09e7466206bc4a0a

SHA512
4b767925755688b42e6ccb5dfcf144351c8dc837da9b88bdb7b70790865cc3e9227cef9940d71fde2b8a6eacf50e0befcc72f085bea275424ee106ab1add8786

Download Submit
memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download