6fd5be17a36e945b77fe3770ae24a616f1b4a0094b71a88a333018014334d038

Resubmissions

21/11/2022, 13:51

221121-q5vgpscc42

18/11/2022, 14:58

221118-sb92eade6y8

Analysis

max time kernel
29s
max time network
145s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18/11/2022, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MyNewFileChr.exe
Size 700.6MB
Sample221118-sb92eade6y
SHA256 e46e004f9939767790ef6be5273a5cc7c18b1eb4c42668e9516ac6f630ee5e53
MD5 bcaf5351fc6033f9a48256674c73ed81
SHA1 3d3f9756a1e26f6a7faed90b78cd5653e8e109b6
SHA512 56a5f5286b9f16511b49e748835ff06f58a74458f6cf83d7d20e1c6773c8bac2593cb185c0a3e7372db4f40b51b2a315cdfdd264aff43c6a1420591de6076282
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doSCA:r3B4IzSGfmXYOWPaZoECL
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1292	system_update.exe
1980	system_update.exe

Loads dropped DLL 2 IoCs

pid	Process
296	cmd.exe
1292	system_update.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 1552	1576	MyNewFileChr.exe	28
PID 1292 set thread context of 1980	1292	system_update.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1576 wrote to memory of 1552	1576	MyNewFileChr.exe	28
PID 1552 wrote to memory of 1020	1552	MyNewFileChr.exe	30
PID 1552 wrote to memory of 1020	1552	MyNewFileChr.exe	30
PID 1552 wrote to memory of 1020	1552	MyNewFileChr.exe	30
PID 1552 wrote to memory of 1020	1552	MyNewFileChr.exe	30
PID 1552 wrote to memory of 296	1552	MyNewFileChr.exe	32
PID 1552 wrote to memory of 296	1552	MyNewFileChr.exe	32
PID 1552 wrote to memory of 296	1552	MyNewFileChr.exe	32
PID 1552 wrote to memory of 296	1552	MyNewFileChr.exe	32
PID 296 wrote to memory of 1292	296	cmd.exe	34
PID 296 wrote to memory of 1292	296	cmd.exe	34
PID 296 wrote to memory of 1292	296	cmd.exe	34
PID 296 wrote to memory of 1292	296	cmd.exe	34
PID 296 wrote to memory of 1292	296	cmd.exe	34
PID 296 wrote to memory of 1292	296	cmd.exe	34
PID 296 wrote to memory of 1292	296	cmd.exe	34
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35
PID 1292 wrote to memory of 1980	1292	system_update.exe	35

C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe
"C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe
  "C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir C:\Users\Admin\tmp
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "C:\Users\Admin\tmp\system_update.exe 1"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:296
  - - C:\Users\Admin\tmp\system_update.exe
      C:\Users\Admin\tmp\system_update.exe 1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Users\Admin\tmp\system_update.exe
        
        "C:\Users\Admin\tmp\system_update.exe"
        5⤵
        Executes dropped EXE
        
        PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system_update.exe

Path C:\Users\Admin\tmp\system_update.exe
Size 418.5MB
SHA256 9441f05bcf7ed45c60574c6a109cf97f7b86dedf34ddc640072347dc9624bf1f
MD5 8981b2ec96993b94346c18496b120c26
SHA1 7a57691336ec8775780f136061a96d0792161e8f
SHA512 97e077c60798ced749a1dbd50fe4831ec24d110cc1c0022383a75f3fbeacf07b6d91c52f65fa745f34ed24cf60863ee110a2c393bdb7683b3a9a550d2e2c43a2
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_update.exe

Path C:\Users\Admin\tmp\system_update.exe
Size 344.4MB
SHA256 5e7f0c24fd7282108d137e011f7e2d7ca012e34b01186b4749e3b3549a8d45a0
MD5 787b74c6762d542d04524eddfcc90abe
SHA1 80f3921cae8630ea8db69ca437e4e368812bb148
SHA512 2353364f6e91e4d4603496b89cf39775926c2d3e17bf9d28c21a353726b1062001391e53d23d843be13fc0fd83300789e10a67eca967348e26738228494328c6
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_update.exe

Path C:\Users\Admin\tmp\system_update.exe
Size 426.6MB
SHA256 f9b4131bdd02324295b29660fc4b7b20e0cf74d82bec55ae8da997e9609d1d4f
MD5 908d6b4a7d8817a99898037bb5fc6e63
SHA1 6f79eb8865604c47439cf42ea0cce3a0dac60502
SHA512 45c3493c6a1c30f41928318c4e590f036ef0beb80525a77b47c6f8eea9ffef1fa6a7997d881a915349ee5c546baeee22b7cb18adf6826a2fa5960f0708af1a3f
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_update.exe

Path \Users\Admin\tmp\system_update.exe
Size 442.6MB
SHA256 9e81042ce173e54530583ae3b59b9353594c313858999fd55c66759142f19202
MD5 7a694b64f2aa2b23d2164293659d7ced
SHA1 2557c4ee60910747ecaf59f5cbcef302d3bcad54
SHA512 4a98748cbc206096c424d144466ff512831e19ec115a84eccc2a59cb2ebd410b21d9f5b3a396c259c37e137a8bf46c2186f593e8508b8769c2e6d9bf8dda6305
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_update.exe

Path \Users\Admin\tmp\system_update.exe
Size 427.4MB
SHA256 3a542872a35b76cc15e24dc744cf3b2b91b54a90f1065e08766dddc316b55ef9
MD5 8b37e53c5929f1f79a3aac132628ad28
SHA1 44a7aaa5ec161d526f2530b59fb76c1d32f61deb
SHA512 910e42603588a90aae9015fbebdbb036b3ed3de720a3f3f13fdca0ccda28aabd2804de311c2e5b6e83739bc666deb1c3964f5d27bb84741c1945fa92f34263a0
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1292-78-0x0000000000FE0000-0x0000000001082000-memory.dmp

Download

memory/1552-60-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-58-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-70-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-65-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-73-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-69-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-55-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-68-0x0000000075C81000-0x0000000075C83000-memory.dmp

Download

memory/1552-63-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-62-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1552-56-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1576-54-0x0000000000910000-0x00000000009B2000-memory.dmp

Download

memory/1980-95-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1980-96-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads