a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9

Analysis

max time kernel
128s
max time network
83s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9.exe
Size

26KB
MD5

32a8efd4d9ba886babe2ff7a738fc926
SHA1

8dfadaa3e900fa5beef56d7e9f0f852b2be4d779
SHA256

a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9
SHA512

2cf2ad83d0aecade37a9ed2886068c0d7a96ee8664a6f7e2bd7efa157cb4b3891da37ee8b2d64b1f3f6c8342ae114740c7c28e0cc11c672c2b2b86d8cde8d2df
SSDEEP

384:FLIkUXMoGDN8z6dz7Y9EAxsdHJAquJtjU4VrcccQxBY2YOjtksTOMTQTQAIMe:FIkUXWz7Y9ncyqufw45ccc0S2BkJIMe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1540	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1540	test.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1540	1092	a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9.exe	27
PID 1092 wrote to memory of 1540	1092	a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9.exe	27
PID 1092 wrote to memory of 1540	1092	a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9.exe	27

C:\Users\Admin\AppData\Local\Temp\a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9.exe
"C:\Users\Admin\AppData\Local\Temp\a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Roaming\test.exe
  "C:\Users\Admin\AppData\Roaming\test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\test.exe

Filesize
26KB

MD5
32a8efd4d9ba886babe2ff7a738fc926

SHA1
8dfadaa3e900fa5beef56d7e9f0f852b2be4d779

SHA256
a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9

SHA512
2cf2ad83d0aecade37a9ed2886068c0d7a96ee8664a6f7e2bd7efa157cb4b3891da37ee8b2d64b1f3f6c8342ae114740c7c28e0cc11c672c2b2b86d8cde8d2df

Download Submit
C:\Users\Admin\AppData\Roaming\test.exe

Filesize
26KB

MD5
32a8efd4d9ba886babe2ff7a738fc926

SHA1
8dfadaa3e900fa5beef56d7e9f0f852b2be4d779

SHA256
a21a14271c1f710715c0d0cb99a93e0808a964f0b697cbccfc3de2d006313cb9

SHA512
2cf2ad83d0aecade37a9ed2886068c0d7a96ee8664a6f7e2bd7efa157cb4b3891da37ee8b2d64b1f3f6c8342ae114740c7c28e0cc11c672c2b2b86d8cde8d2df

Download Submit
memory/1092-54-0x000007FEF4230000-0x000007FEF4C53000-memory.dmp

Filesize
10.1MB

Download
memory/1092-55-0x000007FEF3190000-0x000007FEF4226000-memory.dmp

Filesize
16.6MB

Download
memory/1092-62-0x0000000001DE6000-0x0000000001E05000-memory.dmp

Filesize
124KB

Download
memory/1092-64-0x0000000001DE6000-0x0000000001E05000-memory.dmp

Filesize
124KB

Download
memory/1540-59-0x000007FEF4230000-0x000007FEF4C53000-memory.dmp

Filesize
10.1MB

Download
memory/1540-60-0x000007FEF3190000-0x000007FEF4226000-memory.dmp

Filesize
16.6MB

Download
memory/1540-61-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1540-63-0x00000000006C6000-0x00000000006E5000-memory.dmp

Filesize
124KB

Download
memory/1540-65-0x00000000006C6000-0x00000000006E5000-memory.dmp

Filesize
124KB

Download