5bd7a1d3894b770b58190bfb3c6020344ce47389ccdc5b080cff9d23718ff4b3

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.7MB
Sample221109-twddlsbhan
SHA256 5bd7a1d3894b770b58190bfb3c6020344ce47389ccdc5b080cff9d23718ff4b3
MD5 2247ba7e0db82c2df1ef7cd3833af020
SHA1 71bba2153297955c1cc4d84792fd0e5ba52aad49
SHA512 1524617ee0bab3812a96831df9c2e7c58a5c8c472951f38db77cb21e34de5f3a670d855a08d6b0935632928a5bfd8e34e29b8340e0ea4021a180968478b1162b
SSDEEP 49152:KylPhma2CuPC2PCBIKTOQenUM3p32gqIJNeY+Zv6lV4gj:KylPhy1PFPeenUQxXeY9lNj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1688	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1688	2032	file.exe	27
PID 2032 wrote to memory of 1688	2032	file.exe	27
PID 2032 wrote to memory of 1688	2032	file.exe	27
PID 2032 wrote to memory of 1688	2032	file.exe	27
PID 2032 wrote to memory of 1688	2032	file.exe	27
PID 2032 wrote to memory of 1688	2032	file.exe	27
PID 2032 wrote to memory of 1688	2032	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" _sPEp.A /u /S
  2⤵
  - Loads dropped DLL
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sPEp.A

Path C:\Users\Admin\AppData\Local\Temp\_sPEp.A
Size 1.8MB
SHA256 b5026f0617dd8691f7d35ee57c96bf978aa446796076f24b83dec44fdf973f13
MD5 f825c3978afa60872b56f737758dd0d6
SHA1 d94ca2dc54c41693d2bb18c9857e6b3b6a491c2c
SHA512 7de1c8f7997dc7be1bde647a6fb31cf515865ff24430d37d4b182542746e6d1a2659f652484ab627cd74c6c2e2dd42d94af01b7471cd912fab442bd0f05085cf
SSDEEP 49152:oeBjh1PCEPCoPCEPCEPCANKQ9gJw91Yco1BUhhwmwA2w:t1PhP5PhPhPFQQ6Jw9pGaSmwA2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

_spEp.A

Path \Users\Admin\AppData\Local\Temp\_spEp.A
Size 1.8MB
SHA256 b5026f0617dd8691f7d35ee57c96bf978aa446796076f24b83dec44fdf973f13
MD5 f825c3978afa60872b56f737758dd0d6
SHA1 d94ca2dc54c41693d2bb18c9857e6b3b6a491c2c
SHA512 7de1c8f7997dc7be1bde647a6fb31cf515865ff24430d37d4b182542746e6d1a2659f652484ab627cd74c6c2e2dd42d94af01b7471cd912fab442bd0f05085cf
SSDEEP 49152:oeBjh1PCEPCoPCEPCEPCANKQ9gJw91Yco1BUhhwmwA2w:t1PhP5PhPhPFQQ6Jw9pGaSmwA2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1688-59-0x0000000001F30000-0x000000000210D000-memory.dmp

Download

memory/1688-61-0x00000000025E0000-0x00000000026EC000-memory.dmp

Download

memory/1688-60-0x0000000002370000-0x00000000024C7000-memory.dmp

Download

memory/1688-62-0x0000000000490000-0x000000000055C000-memory.dmp

Download

memory/1688-63-0x00000000026F0000-0x00000000027AA000-memory.dmp

Download

memory/1688-66-0x00000000025E0000-0x00000000026EC000-memory.dmp

Download

memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads