2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6

Analysis

max time kernel
47s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6.exe
Size

44KB
MD5

5bcc12d64e1909054c6ebb61fed65dc1
SHA1

bab26f718ff0fa0f686932636280354a71b30b23
SHA256

2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6
SHA512

4f4c490933cab2e97685e39f9f002fd65c02c7e2a9418751e7b0ef5a9e2ced97e4dc213aaa8d213028b70deb4804687a566278fa8c25dd8ef5e6b4f5ac9739be
SSDEEP

768:SiNDm84Lr1PRSlAkO5anmH7LDBeENP/P2Npv6PI0N:SN5YmbLRNP3yv6PD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
520	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1384	1096	2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6.exe	28
PID 1096 wrote to memory of 1384	1096	2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6.exe	28
PID 1096 wrote to memory of 1384	1096	2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6.exe	28
PID 1096 wrote to memory of 1384	1096	2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6.exe	28

C:\Users\Admin\AppData\Local\Temp\2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6.exe
"C:\Users\Admin\AppData\Local\Temp\2d2b9f6541ab60ac55da6a4af4e3d1850b08065987209116dac385304f6cf0a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\subfile.jpg
  2⤵
  PID:1384

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\subfile.jpg

Filesize
14KB

MD5
6e8cbbd65bcc8dcf77018e638838c473

SHA1
5e7ddcffa1a9175084daaa1c51d8073b1ce9e256

SHA256
bb31431da1367e45ea3c21091e31b8893ab5e440f347c7a493e525c0adb50a0e

SHA512
843a2d34de841644bf49622d684430bc9be17298d4972fadcac4cd312c24099af8e66ba6d3770cd152e6bec236dff65e7762bd2c430af269fed9509b7a9e3d67

Download Submit
memory/1384-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download