32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b

Analysis

max time kernel
279s
max time network
335s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
Size

1.6MB
MD5

36f968ce16766e270a00b7922bce9ab8
SHA1

a4ea568b70248491fcd2b8e9d0657161372499dc
SHA256

32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b
SHA512

3c42da85dea98ec7f6aa5efaa9983c43a405f5d20937d02d2339e6e124fcfe39a58fecfe2044475ea506069db764b445373773620922c2445ec3b3ca4bee4efd
SSDEEP

24576:C4lavt0LkLL9IMixoEgea1ar6hqt/XCyFeSiCO0u3gc55q9MmCS:1kwkn9IMHea1C6O/XFeAOUgaPCS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

pid process

1548 32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

pid	process
1548	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

description	pid	process	target process
PID 1580 set thread context of 1548	1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

Processes:

32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe:Zone.Identifier:$DATA	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

pid	process
1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

description	pid	process	target process
PID 1580 wrote to memory of 1548	1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
PID 1580 wrote to memory of 1548	1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
PID 1580 wrote to memory of 1548	1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
PID 1580 wrote to memory of 1548	1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
PID 1580 wrote to memory of 1548	1580	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe	32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

C:\Users\Admin\AppData\Local\Temp\32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
"C:\Users\Admin\AppData\Local\Temp\32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe"
1⤵
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe
"C:\Users\Admin\AppData\Local\Temp\32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe"
2⤵
- Executes dropped EXE
PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b.exe

Filesize
1.6MB

MD5
36f968ce16766e270a00b7922bce9ab8

SHA1
a4ea568b70248491fcd2b8e9d0657161372499dc

SHA256
32bc1b02ed05e9f1c7a4f2571b47f1756a8f51ccc85e331d85117dbb3204902b

SHA512
3c42da85dea98ec7f6aa5efaa9983c43a405f5d20937d02d2339e6e124fcfe39a58fecfe2044475ea506069db764b445373773620922c2445ec3b3ca4bee4efd

Download Submit
memory/1548-132-0x0000000000000000-mapping.dmp

Download
memory/1548-133-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download
memory/1548-135-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download
memory/1548-136-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download
memory/1548-137-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download
memory/1548-138-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download