3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe
Size

3.1MB
MD5

9bd594e4e99d2b9a0e6e259e05f5c077
SHA1

8a9f51d82d1c87527d8d33a96fe085a19a8df301
SHA256

3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9
SHA512

c97383e34d4d23aab1066fcb0cb4e45edf3caaa945bc8fd6ffe9791424b6715fe90d07e5b288e195e45aee928cd4a91fcadbaefb5ce9d20688c690152282eba9
SSDEEP

49152:S9vzBzNqtuxfSOsRRODpK3zl3ZkPmnA0BM56rZ/mfTn+BHZxZ:SRBzNAROD4AmA0BjrZ/R5P

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1348	m4xrnheh.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe:Zone.Identifier	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe
608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe
1348	m4xrnheh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 1496	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	28
PID 608 wrote to memory of 1496	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	28
PID 608 wrote to memory of 1496	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	28
PID 608 wrote to memory of 1496	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	28
PID 608 wrote to memory of 1348	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	30
PID 608 wrote to memory of 1348	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	30
PID 608 wrote to memory of 1348	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	30
PID 608 wrote to memory of 1348	608	3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe	30

C:\Users\Admin\AppData\Local\Temp\3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe
"C:\Users\Admin\AppData\Local\Temp\3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo>"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe:Zone.Identifier"
  2⤵
  - Drops startup file
  PID:1496
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe

Filesize
3.1MB

MD5
9bd594e4e99d2b9a0e6e259e05f5c077

SHA1
8a9f51d82d1c87527d8d33a96fe085a19a8df301

SHA256
3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9

SHA512
c97383e34d4d23aab1066fcb0cb4e45edf3caaa945bc8fd6ffe9791424b6715fe90d07e5b288e195e45aee928cd4a91fcadbaefb5ce9d20688c690152282eba9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe

Filesize
3.1MB

MD5
9bd594e4e99d2b9a0e6e259e05f5c077

SHA1
8a9f51d82d1c87527d8d33a96fe085a19a8df301

SHA256
3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9

SHA512
c97383e34d4d23aab1066fcb0cb4e45edf3caaa945bc8fd6ffe9791424b6715fe90d07e5b288e195e45aee928cd4a91fcadbaefb5ce9d20688c690152282eba9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe:Zone.Identifier

Filesize
13B

MD5
38de427224a5082a04fe82e2bd4ea9ec

SHA1
7e4a53de1f83762dd2febd39b818e2258bc83bc1

SHA256
12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028

SHA512
ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe

Filesize
3.1MB

MD5
9bd594e4e99d2b9a0e6e259e05f5c077

SHA1
8a9f51d82d1c87527d8d33a96fe085a19a8df301

SHA256
3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9

SHA512
c97383e34d4d23aab1066fcb0cb4e45edf3caaa945bc8fd6ffe9791424b6715fe90d07e5b288e195e45aee928cd4a91fcadbaefb5ce9d20688c690152282eba9

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m4xrnheh.exe

Filesize
3.1MB

MD5
9bd594e4e99d2b9a0e6e259e05f5c077

SHA1
8a9f51d82d1c87527d8d33a96fe085a19a8df301

SHA256
3b7d9ce838d439688e22bd770c6d2f7a3a3a9f8e61699d552c56bd9b747053c9

SHA512
c97383e34d4d23aab1066fcb0cb4e45edf3caaa945bc8fd6ffe9791424b6715fe90d07e5b288e195e45aee928cd4a91fcadbaefb5ce9d20688c690152282eba9

Download Submit
memory/608-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download