b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe
Size

6.4MB
MD5

d7b80447e55c26a262c1fc231f8240b4
SHA1

0a837787fbeb3109fb4ee3ba3582a62e9105eeea
SHA256

b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770
SHA512

704f583429837a5688b01b50bfccb36a703be1b2d467b6dfcae9bcb4f702590c64a540710538f1798aa09a6ac8e244f637e042f8305cf6f93c4c49777c4e0702
SSDEEP

98304:Ylxl6Wu8deMSAN6Y/KH2Vl98th0s3F9kpUtXNwl3Nw55:YlxlxuO9ScUH2V4rziUNUNG5

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

B61B728BA9F96CBC.exe

pid process

516 B61B728BA9F96CBC.exe

pid	process
516	B61B728BA9F96CBC.exe

Loads dropped DLL 2 IoCs

Processes:

b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe

pid	process
948	b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe
948	b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe

description	pid	process	target process
PID 948 wrote to memory of 516	948	b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe	B61B728BA9F96CBC.exe
PID 948 wrote to memory of 516	948	b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe	B61B728BA9F96CBC.exe
PID 948 wrote to memory of 516	948	b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe	B61B728BA9F96CBC.exe
PID 948 wrote to memory of 516	948	b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe	B61B728BA9F96CBC.exe

C:\Users\Admin\AppData\Local\Temp\b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe
"C:\Users\Admin\AppData\Local\Temp\b8662684a5969a91baf3ae96f71de726df0a8bcfd98bbc0c6d08e6c5ee6e7770.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\B61B728BA9F96CBC.exe
  "C:\Users\Admin\AppData\Local\Temp\B61B728BA9F96CBC.exe" 1020
  2⤵
  - Executes dropped EXE
  PID:516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B61B728BA9F96CBC.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
\Users\Admin\AppData\Local\Temp\B61B728BA9F96CBC.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
\Users\Admin\AppData\Local\Temp\B61B728BA9F96CBC.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
memory/516-63-0x0000000000000000-mapping.dmp

Download
memory/948-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/948-55-0x0000000002BA0000-0x0000000002D78000-memory.dmp

Filesize
1.8MB

Download
memory/948-56-0x0000000002BA0000-0x0000000002D78000-memory.dmp

Filesize
1.8MB

Download
memory/948-57-0x0000000002BA0000-0x0000000002D78000-memory.dmp

Filesize
1.8MB

Download
memory/948-59-0x0000000000400000-0x0000000000B4C000-memory.dmp

Filesize
7.3MB

Download
memory/948-60-0x0000000002BA0000-0x0000000002D78000-memory.dmp

Filesize
1.8MB

Download
memory/948-66-0x0000000000400000-0x0000000000B4C000-memory.dmp

Filesize
7.3MB

Download
memory/948-67-0x0000000002BA0000-0x0000000002D78000-memory.dmp

Filesize
1.8MB

Download