Analysis
-
max time kernel
49s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
23-11-2022 08:35
General
-
Target
ff4b2ba176b69a7d0b1267b8e4a6a1c3a6385e9f5a2a20791d36e5f1cd2dabd7.exe
-
Size
1.6MB
-
MD5
a4b99341112beb4125f0bdad3bea69f8
-
SHA1
0bf388c7dd5d762585b7b2841118909ffc2a5700
-
SHA256
ff4b2ba176b69a7d0b1267b8e4a6a1c3a6385e9f5a2a20791d36e5f1cd2dabd7
-
SHA512
4fd73b7f10cbf37f7a17253c35042d5a41eb1cdbe3665523c4566c23e395e22570169560518d4d81a65d019c65f536477ed799f4facf6d104f194934f86b8420
-
SSDEEP
49152:gJ4Ncy2+f0XAewvvx5RS7LKaK2A2lzRyE:gJ4CIfiAewvZ4zAizd
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff4b2ba176b69a7d0b1267b8e4a6a1c3a6385e9f5a2a20791d36e5f1cd2dabd7.exe"C:\Users\Admin\AppData\Local\Temp\ff4b2ba176b69a7d0b1267b8e4a6a1c3a6385e9f5a2a20791d36e5f1cd2dabd7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" -y .\GBa7T.0kv2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD52d651abc49d33447713b0fd34f221ae8
SHA1a20738055f2e9e14baec621d9c0f2fee612414ed
SHA256631576338236d320ffffe02311493bad49605b5b93fe7a227888553de26ee35b
SHA512d37ad62467e3bfb0aa39c8e593b53453f4f69868cc5e5f40256d96809410921171edb8882d0749d763538c5ef9a48ffaff7d59da48e8c9412abc856115a17c1e
-
Filesize
1.7MB
MD52d651abc49d33447713b0fd34f221ae8
SHA1a20738055f2e9e14baec621d9c0f2fee612414ed
SHA256631576338236d320ffffe02311493bad49605b5b93fe7a227888553de26ee35b
SHA512d37ad62467e3bfb0aa39c8e593b53453f4f69868cc5e5f40256d96809410921171edb8882d0749d763538c5ef9a48ffaff7d59da48e8c9412abc856115a17c1e
-
Filesize
1.7MB
MD52d651abc49d33447713b0fd34f221ae8
SHA1a20738055f2e9e14baec621d9c0f2fee612414ed
SHA256631576338236d320ffffe02311493bad49605b5b93fe7a227888553de26ee35b
SHA512d37ad62467e3bfb0aa39c8e593b53453f4f69868cc5e5f40256d96809410921171edb8882d0749d763538c5ef9a48ffaff7d59da48e8c9412abc856115a17c1e
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
Filesize
1.2MB
-
Filesize
1.1MB
-
Filesize
1.1MB