81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48

Analysis

max time kernel
172s
max time network
194s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe
Size

33KB
MD5

b064f8da86db1c091e623781ab464d8a
SHA1

600dd091a46f83c0ff03f1e7bfda8f7c1cc4f312
SHA256

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48
SHA512

9e09d6f85874a40ff83f3641cdafe8ad50094f4d4007aae6a5248bac56f8301a9fc08fca65ae77f9fd735fbb6689059f3f435a9d42c1d37a0f59ee7b5f9b0e30
SSDEEP

384:VQpmKKS+jqtF92NceQkVKF8z1zbNjCxk8:gm1S+IONcf0hNj+r

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vuzbz.exe

pid process

268 vuzbz.exe
Deletes itself 1 IoCs

Processes:

vuzbz.exe

pid process

268 vuzbz.exe

pid	process
268	vuzbz.exe

pid	process
268	vuzbz.exe

Loads dropped DLL 2 IoCs

Processes:

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

pid	process
360	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe
360	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

description	pid	process	target process
PID 360 wrote to memory of 268	360	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe	vuzbz.exe
PID 360 wrote to memory of 268	360	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe	vuzbz.exe
PID 360 wrote to memory of 268	360	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe	vuzbz.exe
PID 360 wrote to memory of 268	360	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe	vuzbz.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings	81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe

C:\Users\Admin\AppData\Local\Temp\81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe
"C:\Users\Admin\AppData\Local\Temp\81582bbaaa100d695cca763cdb9791e280e4153bc3215f2f39d356408018aa48.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- System policy modification
PID:360

C:\Users\Admin\AppData\Local\Temp\vuzbz.exe
"C:\Users\Admin\AppData\Local\Temp\vuzbz.exe"
2⤵
- Executes dropped EXE
- Deletes itself
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vuzbz.exe
Filesize
33KB

MD5
fede96c7249f0ca353987848b9066348

SHA1
b94a8a300dfe23787bc97df9c47a362c25a6159e

SHA256
93b573611cad6c4a87704eee4bde8ba0e8a0aa5ea504c5f2f815f495dccd524d

SHA512
20cf1e211b691228b3f0b5586d9ff43cb66f249e08e4f14b234c32fcbc39c6ffaef9088d59c6ce5e400a047aed0532eb2edee1162f48919bba38f27e8370b2b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\vuzbz.exe
Filesize
33KB

MD5
fede96c7249f0ca353987848b9066348

SHA1
b94a8a300dfe23787bc97df9c47a362c25a6159e

SHA256
93b573611cad6c4a87704eee4bde8ba0e8a0aa5ea504c5f2f815f495dccd524d

SHA512
20cf1e211b691228b3f0b5586d9ff43cb66f249e08e4f14b234c32fcbc39c6ffaef9088d59c6ce5e400a047aed0532eb2edee1162f48919bba38f27e8370b2b6

Download Submit
\Users\Admin\AppData\Local\Temp\vuzbz.exe
Filesize
33KB

MD5
fede96c7249f0ca353987848b9066348

SHA1
b94a8a300dfe23787bc97df9c47a362c25a6159e

SHA256
93b573611cad6c4a87704eee4bde8ba0e8a0aa5ea504c5f2f815f495dccd524d

SHA512
20cf1e211b691228b3f0b5586d9ff43cb66f249e08e4f14b234c32fcbc39c6ffaef9088d59c6ce5e400a047aed0532eb2edee1162f48919bba38f27e8370b2b6

Download Submit
\Users\Admin\AppData\Local\Temp\vuzbz.exe
Filesize
33KB

MD5
fede96c7249f0ca353987848b9066348

SHA1
b94a8a300dfe23787bc97df9c47a362c25a6159e

SHA256
93b573611cad6c4a87704eee4bde8ba0e8a0aa5ea504c5f2f815f495dccd524d

SHA512
20cf1e211b691228b3f0b5586d9ff43cb66f249e08e4f14b234c32fcbc39c6ffaef9088d59c6ce5e400a047aed0532eb2edee1162f48919bba38f27e8370b2b6

Download Submit
memory/268-57-0x0000000000000000-mapping.dmp

Download
memory/268-64-0x00000000002E0000-0x00000000002F5000-memory.dmp

Filesize
84KB

Download
memory/360-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/360-61-0x0000000000400000-0x00000000004149F0-memory.dmp

Filesize
82KB

Download
memory/360-62-0x0000000000320000-0x0000000000335000-memory.dmp

Filesize
84KB

Download
memory/360-63-0x00000000004F0000-0x0000000000505000-memory.dmp

Filesize
84KB

Download