Analysis

  • max time kernel
    44s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 20:55

General

  • Target

    c16322f3dbb8a3bddedd0d2c19118aa2936957537de0460c23a233f7450a9cf9.exe

  • Size

    53KB

  • MD5

    5388bc12266d3f0690081a0c175d7e57

  • SHA1

    6ac1d1c6b6d30e02d135314ac4210c9dbd8da67c

  • SHA256

    c16322f3dbb8a3bddedd0d2c19118aa2936957537de0460c23a233f7450a9cf9

  • SHA512

    cf83defe27baa895bdf9d31ae4eb6b7e9c6c57dfdb4d82911e46cd0568e1eb89a6ba616a2fe72dbf83e7ab0a74b5a7c48de7cece082e574d9873e17071700978

  • SSDEEP

    768:uJChTypVTFylNCQKowZS4E6SynTruH712N3b4wFBOV1mJt6oRZPJW2q5Q/2wRT:uAhTyTTFQNC13U4rtnDb4tmJ8AJq4l

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c16322f3dbb8a3bddedd0d2c19118aa2936957537de0460c23a233f7450a9cf9.exe
    "C:\Users\Admin\AppData\Local\Temp\c16322f3dbb8a3bddedd0d2c19118aa2936957537de0460c23a233f7450a9cf9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"
      2⤵
        PID:2028
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\1.vbs"
        2⤵
          PID:836

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\newsetup.vbs

        Filesize

        651B

        MD5

        4736e7158c27f244482f5a614b9dbdae

        SHA1

        d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9

        SHA256

        b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc

        SHA512

        cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824

      • memory/836-57-0x0000000000000000-mapping.dmp

      • memory/1116-54-0x0000000076961000-0x0000000076963000-memory.dmp

        Filesize

        8KB

      • memory/2028-55-0x0000000000000000-mapping.dmp