Analysis
-
max time kernel
39s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 23:14
Static task
static1
Behavioral task
behavioral1
Sample
b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe
Resource
win10v2004-20221111-en
General
-
Target
b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe
-
Size
860KB
-
MD5
56d71caa95dd6e8f1c8c63f1ddfe72d0
-
SHA1
e2dfed7f87b89f49c1dea3ffdff0cc508c249891
-
SHA256
b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9
-
SHA512
b8739d605655eb5a4e7694242f6f5fe00e49d47353c358ea050072ec7da30e2f819ba7ea316abac08cf2c234607e3fb01e94c85afa9c81e5176aebae7ec024e6
-
SSDEEP
12288:9RBk7MpC7tYR4eYLEkiw4PKEgOHS1ZBvKEjGbCJlLQzROAvDb3j0H6LVch:9FQeYLbKKEPS1bvKE2yQzROArb3jIGE
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1892-55-0x0000000000400000-0x00000000004E7000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1892 set thread context of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28 PID 1892 wrote to memory of 752 1892 b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe"C:\Users\Admin\AppData\Local\Temp\b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe"C:\Users\Admin\AppData\Local\Temp\b84ac56586dd1129e00dffe8229df393541ca5846306946b1cd4ed946b2b36c9.exe"2⤵PID:752
-