2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2

Analysis

max time kernel
159s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2.exe
Size

932KB
MD5

0f2cf065ccb74f29e76de9ad23991190
SHA1

4e90ed38e3b05ff1a666ae75e9ab16db5a11c4d7
SHA256

2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2
SHA512

495a9cbd82d2d8fcda05c330c3959e08ed9917263c4c25941541dfa79ab5840f580e2a7331293cbaa0a9e991c83e01f5b2501e3790585a5ef4496076d00641de
SSDEEP

24576:P1/aGLDCM4D8ayGMZo8/cpnCc63AzRTJUpYw:gD8ayGMZoL2QPUpV

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4964	lrshu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\lrshu.exe"	lrshu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4964	4976	2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2.exe	80
PID 4976 wrote to memory of 4964	4976	2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2.exe	80
PID 4976 wrote to memory of 4964	4976	2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2.exe	80

C:\Users\Admin\AppData\Local\Temp\2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2.exe
"C:\Users\Admin\AppData\Local\Temp\2df4dcf67161d1a5ba4a95e5c8de2a38afeef53daaa6c04bee0d8056d4e138a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\ProgramData\lrshu.exe
  "C:\ProgramData\lrshu.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
70d6cb7dd01ebd5a21af02945d2ae12f

SHA1
05260b3e17a221e66b58d1e5ed1d0f518392159a

SHA256
136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

SHA512
b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

Download Submit
C:\ProgramData\lrshu.exe

Filesize
454KB

MD5
a7ad8b91a8f852c4fddb5e5d8e239612

SHA1
c9ba590281860872920c152d13168b82f5eb40d4

SHA256
1804d1efece71254a65bd5043c3941ad2e575b7919ce4f505f4b80711f083386

SHA512
ee523efeed93aae728672f7965a127d4dfcdc49c57d6b1a00cb15fda74c736cf122f89d3e465b95c90804234da392d4d26b267cdb3815e456906257dba58ee80

Download Submit
C:\ProgramData\lrshu.exe

Filesize
454KB

MD5
a7ad8b91a8f852c4fddb5e5d8e239612

SHA1
c9ba590281860872920c152d13168b82f5eb40d4

SHA256
1804d1efece71254a65bd5043c3941ad2e575b7919ce4f505f4b80711f083386

SHA512
ee523efeed93aae728672f7965a127d4dfcdc49c57d6b1a00cb15fda74c736cf122f89d3e465b95c90804234da392d4d26b267cdb3815e456906257dba58ee80

Download Submit