a51295410f14b81092cd83c7c0ec79e0cdf9d11049fea6ea38266cdb548a290a

Analysis

max time kernel
48s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd8f67be10f75bb05c761fb5c49262a8.exe
Size 1.8MB
Sample221130-chvmascb61
SHA256 a51295410f14b81092cd83c7c0ec79e0cdf9d11049fea6ea38266cdb548a290a
MD5 bd8f67be10f75bb05c761fb5c49262a8
SHA1 c61bfa22be50ccc8c1e61770fcc43c6d045425b1
SHA512 da19508552852e96670e59e6b06107d4f0bc37ddffbd941a9f21d0fd4e4e319c426911b669ff242def1e788a1e453ff61136628c142b24e7ca56ad10d7f7627b
SSDEEP 49152:C3d3aQiJT3A3Lhh4N8lFZ/lVwnCAyvbTNGTjep:CJaDT3wnM8XRlSn9yvbTNG3u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1304	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1304	1628	bd8f67be10f75bb05c761fb5c49262a8.exe	27
PID 1628 wrote to memory of 1304	1628	bd8f67be10f75bb05c761fb5c49262a8.exe	27
PID 1628 wrote to memory of 1304	1628	bd8f67be10f75bb05c761fb5c49262a8.exe	27
PID 1628 wrote to memory of 1304	1628	bd8f67be10f75bb05c761fb5c49262a8.exe	27
PID 1628 wrote to memory of 1304	1628	bd8f67be10f75bb05c761fb5c49262a8.exe	27
PID 1628 wrote to memory of 1304	1628	bd8f67be10f75bb05c761fb5c49262a8.exe	27
PID 1628 wrote to memory of 1304	1628	bd8f67be10f75bb05c761fb5c49262a8.exe	27

C:\Users\Admin\AppData\Local\Temp\bd8f67be10f75bb05c761fb5c49262a8.exe
"C:\Users\Admin\AppData\Local\Temp\bd8f67be10f75bb05c761fb5c49262a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" .\_IXQ7.H5k /U /S
  2⤵
  - Loads dropped DLL
  PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_IXQ7.H5k

Path C:\Users\Admin\AppData\Local\Temp\_IXQ7.H5k
Size 1.5MB
SHA256 2f2869f5177c3acb89984751e41d3a3366f06a7090a58178c1f83729cc226539
MD5 28f79cacc94b6ecc5948ad377e72e0c5
SHA1 cf7df8f7eeee3190e229f3ca37381b228fed6fdd
SHA512 0f3cbdb47cb7d35de069ce2950267935d0c613432654c723b3564cb75b1e63843df64d5c10184a7604927471c1ceed11b776e93e9cfa62e97a53fd05367af8ed
SSDEEP 24576:r9TuMuUzU+TNzSOgvOEf95E6rB/dLblIHoYyoTKh0I+JoJOa6ktAwMKHT9ptH:5U+TNQ/NJdQLTKBuoJtdJHTrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_IXQ7.H5k

Path \Users\Admin\AppData\Local\Temp\_IXQ7.H5k
Size 1.5MB
SHA256 2f2869f5177c3acb89984751e41d3a3366f06a7090a58178c1f83729cc226539
MD5 28f79cacc94b6ecc5948ad377e72e0c5
SHA1 cf7df8f7eeee3190e229f3ca37381b228fed6fdd
SHA512 0f3cbdb47cb7d35de069ce2950267935d0c613432654c723b3564cb75b1e63843df64d5c10184a7604927471c1ceed11b776e93e9cfa62e97a53fd05367af8ed
SSDEEP 24576:r9TuMuUzU+TNzSOgvOEf95E6rB/dLblIHoYyoTKh0I+JoJOa6ktAwMKHT9ptH:5U+TNQ/NJdQLTKBuoJtdJHTrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1304-59-0x0000000002070000-0x00000000021F7000-memory.dmp

Download

memory/1304-60-0x0000000002360000-0x00000000024BB000-memory.dmp

Download

memory/1304-61-0x00000000025F0000-0x000000000271D000-memory.dmp

Download

memory/1304-62-0x0000000000200000-0x00000000002D0000-memory.dmp

Download

memory/1304-63-0x0000000002720000-0x00000000027D9000-memory.dmp

Download

memory/1304-66-0x00000000025F0000-0x000000000271D000-memory.dmp

Download

memory/1628-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads