6fd5be17a36e945b77fe3770ae24a616f1b4a0094b71a88a333018014334d038

Resubmissions

21/11/2022, 13:51

221121-q5vgpscc42

18/11/2022, 14:58

221118-sb92eade6y8

Analysis

max time kernel
88s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2022, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MyNewFileChr.exe
Size 700.6MB
Sample221118-sb92eade6y
SHA256 e46e004f9939767790ef6be5273a5cc7c18b1eb4c42668e9516ac6f630ee5e53
MD5 bcaf5351fc6033f9a48256674c73ed81
SHA1 3d3f9756a1e26f6a7faed90b78cd5653e8e109b6
SHA512 56a5f5286b9f16511b49e748835ff06f58a74458f6cf83d7d20e1c6773c8bac2593cb185c0a3e7372db4f40b51b2a315cdfdd264aff43c6a1420591de6076282
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doSCA:r3B4IzSGfmXYOWPaZoECL
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4732	system_update.exe
4812	system_update.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5024 set thread context of 1944	5024	MyNewFileChr.exe	83
PID 4732 set thread context of 4812	4732	system_update.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 5024 wrote to memory of 1944	5024	MyNewFileChr.exe	83
PID 1944 wrote to memory of 2852	1944	MyNewFileChr.exe	85
PID 1944 wrote to memory of 2852	1944	MyNewFileChr.exe	85
PID 1944 wrote to memory of 2852	1944	MyNewFileChr.exe	85
PID 1944 wrote to memory of 2952	1944	MyNewFileChr.exe	87
PID 1944 wrote to memory of 2952	1944	MyNewFileChr.exe	87
PID 1944 wrote to memory of 2952	1944	MyNewFileChr.exe	87
PID 2952 wrote to memory of 4732	2952	cmd.exe	90
PID 2952 wrote to memory of 4732	2952	cmd.exe	90
PID 2952 wrote to memory of 4732	2952	cmd.exe	90
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91
PID 4732 wrote to memory of 4812	4732	system_update.exe	91

C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe
"C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe
  "C:\Users\Admin\AppData\Local\Temp\MyNewFileChr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir C:\Users\Admin\tmp
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "C:\Users\Admin\tmp\system_update.exe 1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\tmp\system_update.exe
      C:\Users\Admin\tmp\system_update.exe 1
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4732
    - - C:\Users\Admin\tmp\system_update.exe
        
        "C:\Users\Admin\tmp\system_update.exe"
        5⤵
        Executes dropped EXE
        
        PID:4812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system_update.exe

Path C:\Users\Admin\tmp\system_update.exe
Size 681.3MB
SHA256 0363c5108bf5e345acd71f7712f8f0ab9857ab88d89f3b6fe81c5e6c5bdc89fc
MD5 c35689b7f5037f06adf4afb84b1ee4ec
SHA1 1ea2bf9a821514d494026d2e7bc3d6277c4fd7bc
SHA512 8aef00de378e1418726897273b676843ca7f4614336445a444069019d4f3c3232d3fa5b14af5c90df276dac348e86baacae0c2b90c908fa749f135d312c6965c
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_update.exe

Path C:\Users\Admin\tmp\system_update.exe
Size 625.2MB
SHA256 c2251844bbdf68a7053b0040cf6ded3a72ed3ccba7fbc625f1f27fadb04b3114
MD5 f0418eabcb7dfc64f9a653255ff0209e
SHA1 caaeb1fa2377496ccf47ad68444495b31f9fbbf3
SHA512 8426eb79534c92513894ba334e7e7be893103377faac04acb85bf05bacfd3716d76ec1634c1eb88b18a743f6f738ea0fb22356c7a16a6832e93b05f627587f4b
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_update.exe

Path C:\Users\Admin\tmp\system_update.exe
Size 670.8MB
SHA256 6db2886095c7f4cbee14376a781d16f953bab4092878a59fd202e2371f568c4d
MD5 e8a45ede792b64a9814e295d3efa56ef
SHA1 562a445afa7dfa385bb7071879c13b4168460bc5
SHA512 3e66785d6438a95e8d2efca9e5b1e8a866ced53295820395b82e72e65fe6a8d06306ede7e84ff38a630b81353e608d6d1a48a28a6617522fe7d05bf36737df98
SSDEEP 12288:rxsSB4IzSGfUVXYOH2P8/48o02zzzzzzzzzzzzzzLWfBTy9eo1doS:r3B4IzSGfmXYOWPaZoEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1944-145-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1944-140-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1944-141-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1944-142-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1944-139-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4812-152-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4812-153-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4812-154-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4812-155-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/5024-135-0x0000000000050000-0x00000000000F2000-memory.dmp

Download

memory/5024-137-0x0000000004A70000-0x0000000004AD6000-memory.dmp

Download

memory/5024-136-0x0000000004F70000-0x0000000005514000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads