805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe
Size

223KB
MD5

a3515422fca53a59a6920dede7c5fd2c
SHA1

d849d7af07ed678fd5d0e9252569c245b2297292
SHA256

805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53
SHA512

e7f4f5281a00a9355cecf770717c62b0721e37e2f55c092b51d72ccb605fbc4e00158d897928114bddc8ff167989d8c189eaa8325aa90bc35a22f6e0c0dbd840
SSDEEP

6144:HP9lNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNdwNMaFuWMGH:HP9iiaNMGfkHriP8L2

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1436	Windows_Events.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\security\window\Windows_Events.exe	805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe
File opened for modification	C:\Windows\security\window\Windows_Events.InstallLog	Windows_Events.exe
File created	C:\Windows\security\window\Windows_Events.InstallState	Windows_Events.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1436	1848	805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe	28
PID 1848 wrote to memory of 1436	1848	805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe	28
PID 1848 wrote to memory of 1436	1848	805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe	28
PID 1848 wrote to memory of 1532	1848	805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe	29
PID 1848 wrote to memory of 1532	1848	805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe	29
PID 1848 wrote to memory of 1532	1848	805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe	29
PID 1532 wrote to memory of 1248	1532	cmd.exe	31
PID 1532 wrote to memory of 1248	1532	cmd.exe	31
PID 1532 wrote to memory of 1248	1532	cmd.exe	31
PID 1248 wrote to memory of 1140	1248	net.exe	32
PID 1248 wrote to memory of 1140	1248	net.exe	32
PID 1248 wrote to memory of 1140	1248	net.exe	32

C:\Users\Admin\AppData\Local\Temp\805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe
"C:\Users\Admin\AppData\Local\Temp\805afeed0aee894d45da02b05c8141e94108a08870020ab707b1caeac920ed53.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\security\window\Windows_Events.exe
  "C:\Windows\security\window\Windows_Events.exe" -i
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1436
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C net start "Windows Events"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\net.exe
    net start "Windows Events"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Windows Events"
      4⤵
      PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\security\window\Windows_Events.exe

Filesize
19KB

MD5
209da7333a508c70f3c5a0535db2076d

SHA1
9296d0351a425178b843fdec9eb7b6b5e782ea36

SHA256
b43d3a805a3a0f5a066eb4300edf3c876760d90e99628e8dce325bcfde986a5f

SHA512
eeec9a1d6195f9dc9cf7d5f39f9e79344b8e2b052901574bba72f0e120bedb4c30750d217a4db4ed34ba3b15357aba9b6ae013f26eec046f75688d76f3ae3932

Download Submit
C:\Windows\security\window\Windows_Events.exe

Filesize
19KB

MD5
209da7333a508c70f3c5a0535db2076d

SHA1
9296d0351a425178b843fdec9eb7b6b5e782ea36

SHA256
b43d3a805a3a0f5a066eb4300edf3c876760d90e99628e8dce325bcfde986a5f

SHA512
eeec9a1d6195f9dc9cf7d5f39f9e79344b8e2b052901574bba72f0e120bedb4c30750d217a4db4ed34ba3b15357aba9b6ae013f26eec046f75688d76f3ae3932

Download Submit
memory/1140-63-0x0000000000000000-mapping.dmp

Download
memory/1248-62-0x0000000000000000-mapping.dmp

Download
memory/1436-56-0x0000000000000000-mapping.dmp

Download
memory/1436-60-0x000007FEF3710000-0x000007FEF4133000-memory.dmp

Filesize
10.1MB

Download
memory/1436-64-0x000007FEF2670000-0x000007FEF3706000-memory.dmp

Filesize
16.6MB

Download
memory/1532-58-0x0000000000000000-mapping.dmp

Download
memory/1848-54-0x000007FEF3710000-0x000007FEF4133000-memory.dmp

Filesize
10.1MB

Download
memory/1848-55-0x000007FEF2670000-0x000007FEF3706000-memory.dmp

Filesize
16.6MB

Download
memory/1848-61-0x0000000000B77000-0x0000000000B96000-memory.dmp

Filesize
124KB

Download
memory/1848-65-0x0000000000B77000-0x0000000000B96000-memory.dmp

Filesize
124KB

Download