b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19

Analysis

max time kernel
59s
max time network
76s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe
Size

1.5MB
MD5

4df397870814106518054ec15e2560b0
SHA1

8813ae4aef59944068e6ed6a0e96e19b57c4c043
SHA256

b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19
SHA512

1a3968d629df66cd148b0e1ea649588531efc19357e68d13bd601f2caabd9cae16edce16dd53199947b0930ec80c4a2e777d2e3746966900b12ce007fff7cd97
SSDEEP

24576:VjqAimkqW+Irznb4lN9XRrRBAagHZIripWieR/24fcnH:V2Ai4W/3G9hwaoaR/z

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
892	~GME061.exe

Loads dropped DLL 2 IoCs

pid	Process
952	b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe
952	b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\folder\shell\EncryptFolder	~GME061.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\EncryptFolder\ = "ÎÄ¼þ¼ÐÊØ»¤Õß2008"	~GME061.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\EncryptFolder\command	~GME061.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\folder\shell\EncryptFolder\command	~GME061.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\EncryptFolder\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\~GME061.exe\" \"%1\""	~GME061.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 892	952	b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe	28
PID 952 wrote to memory of 892	952	b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe	28
PID 952 wrote to memory of 892	952	b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe	28
PID 952 wrote to memory of 892	952	b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe	28

C:\Users\Admin\AppData\Local\Temp\b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe
"C:\Users\Admin\AppData\Local\Temp\b67adc01bed52d18f80eb09bbffde886c314ce1f80805f60cec6f567a8738d19.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\Temp\~GME061.exe
  "C:\Users\Admin\AppData\Local\Temp\~GME061.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~GME061.exe

Filesize
1.2MB

MD5
6e6a2e5ac356f318a45e3689377bf305

SHA1
7602154d4bbe5d6a1242369d7aa9bc4af46f8cf2

SHA256
5c13f8562f39a401b47cac3ae7ac55d9e1a98c7ee7bf7b5232f3c35f81aa4c2c

SHA512
ce10aab89f48dd208639a62c86e915b858ec01f1e5a6c9f68866e3004e994241adce089490ce44a956daf8527c39b4926257991dd53110887d9f6e41018570f0

Download Submit
\Users\Admin\AppData\Local\Temp\~GME061.exe

Filesize
1.2MB

MD5
6e6a2e5ac356f318a45e3689377bf305

SHA1
7602154d4bbe5d6a1242369d7aa9bc4af46f8cf2

SHA256
5c13f8562f39a401b47cac3ae7ac55d9e1a98c7ee7bf7b5232f3c35f81aa4c2c

SHA512
ce10aab89f48dd208639a62c86e915b858ec01f1e5a6c9f68866e3004e994241adce089490ce44a956daf8527c39b4926257991dd53110887d9f6e41018570f0

Download Submit
\Users\Admin\AppData\Local\Temp\~GME061.exe

Filesize
1.2MB

MD5
6e6a2e5ac356f318a45e3689377bf305

SHA1
7602154d4bbe5d6a1242369d7aa9bc4af46f8cf2

SHA256
5c13f8562f39a401b47cac3ae7ac55d9e1a98c7ee7bf7b5232f3c35f81aa4c2c

SHA512
ce10aab89f48dd208639a62c86e915b858ec01f1e5a6c9f68866e3004e994241adce089490ce44a956daf8527c39b4926257991dd53110887d9f6e41018570f0

Download Submit
memory/952-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download