8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39

Analysis

max time kernel
145s
max time network
188s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe
Size

176KB
MD5

eebfdbc8bf820a7751f02050b0f5cd16
SHA1

721db8bf3778570d6cd18fb749030ce99704d094
SHA256

8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39
SHA512

aaa37c396de5e3bdc7ef2c5ce620646192349953f7fbf7dedcdb0f3d81c24b33a6ef05a5d501c08f58df86f1fd0356ee902fccd24da20c9c5ae90aa87c15cf3f
SSDEEP

3072:tsGkrEM7aAMll8bqndiaxemXELx9HRkF/aZNJosLtFLFEKWP1Ih:+V7El8bIdia50TzNJoUHLCl

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ShellExt.exe

pid process

964 ShellExt.exe

pid	process
964	ShellExt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\ShellExt.exe\""	8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe

description	pid	process	target process
PID 1780 wrote to memory of 964	1780	8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe	ShellExt.exe
PID 1780 wrote to memory of 964	1780	8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe	ShellExt.exe
PID 1780 wrote to memory of 964	1780	8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe	ShellExt.exe

C:\Users\Admin\AppData\Local\Temp\8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe
"C:\Users\Admin\AppData\Local\Temp\8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ShellExt.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ShellExt.exe"
2⤵
- Executes dropped EXE
PID:964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\win32host.sys
Filesize
123B

MD5
e42ecce8615d7e1bfbad80e5d87be15c

SHA1
e9409bb368a005a6eb0d7fa043ea245bb6da9ac9

SHA256
58092b34b7eaa09801164d96c809a8aa4b11c169fcb7c762dbf04cde1d0c78a7

SHA512
f5119595ffaf269c9ccd540af2a0410f0c4b0db8e0ca0ba0e73bfc04c2e81120f21766d9654263ae22d98ee13e8a2aebbe5f80573037ee4e847ce590d00dd5fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ShellExt.exe
Filesize
176KB

MD5
eebfdbc8bf820a7751f02050b0f5cd16

SHA1
721db8bf3778570d6cd18fb749030ce99704d094

SHA256
8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39

SHA512
aaa37c396de5e3bdc7ef2c5ce620646192349953f7fbf7dedcdb0f3d81c24b33a6ef05a5d501c08f58df86f1fd0356ee902fccd24da20c9c5ae90aa87c15cf3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ShellExt.exe
Filesize
176KB

MD5
eebfdbc8bf820a7751f02050b0f5cd16

SHA1
721db8bf3778570d6cd18fb749030ce99704d094

SHA256
8ba41c7311481426b3858304c2ef122c3121123abcb9387c8b0bd300b1c5fe39

SHA512
aaa37c396de5e3bdc7ef2c5ce620646192349953f7fbf7dedcdb0f3d81c24b33a6ef05a5d501c08f58df86f1fd0356ee902fccd24da20c9c5ae90aa87c15cf3f

Download Submit
memory/964-56-0x0000000000000000-mapping.dmp

Download
memory/964-59-0x000007FEF42F0000-0x000007FEF4D13000-memory.dmp

Filesize
10.1MB

Download
memory/1780-54-0x000007FEF3410000-0x000007FEF3E33000-memory.dmp

Filesize
10.1MB

Download
memory/1780-55-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Filesize
8KB

Download