c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01

Analysis

max time kernel
55s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe
Size

169KB
MD5

a9d5cfa5ee759c08fa493f0cbbf94b07
SHA1

d4616ccab3e56897372f5000eb37cac325c7c3fc
SHA256

c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01
SHA512

89cac41207345122e98722d941fbf7620567cec308194a31202d50fdb181a3ad5dbd3afd7d18b4f1fd82b429b1fbb50c2f603f38005bf3a2c70df8c9ea83af53
SSDEEP

3072:07Mm0JSQqBMmkMZSYrtEciEtOf/7EYfNBbLw0RzVwi8DyEPCulYe4myrkjC1zz5Q:RJSQqBM3Ys+AF+h1vk2CRbNMQHIbyqTR

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
780	calc.exe

Loads dropped DLL 2 IoCs

pid	Process
1696	c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe
1696	c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 780	1696	c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe	28
PID 1696 wrote to memory of 780	1696	c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe	28
PID 1696 wrote to memory of 780	1696	c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe	28
PID 1696 wrote to memory of 780	1696	c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe	28

C:\Users\Admin\AppData\Local\Temp\c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe
"C:\Users\Admin\AppData\Local\Temp\c198ba77599879f1f5661105b070243e969e8c072c73324f496a7ed6804b3b01.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\calc.exe
  "C:\Users\Admin\AppData\Local\Temp\calc.exe"
  2⤵
  - Executes dropped EXE
  PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\calc.exe

Filesize
89KB

MD5
29bac78bb5f8aa8c5c815f992928cfc6

SHA1
65be62c00365877a2d718ade5f8d78139abd9b83

SHA256
ddf6696f90a73e016c88f2915a73d00ee9bf2100b1f314857554d21892c9e477

SHA512
1605abbbdfd4b5a6d03fade5dc573940175f521986574cbc0e434c27e3cf79ec3b8eb06e135166b1dde90ad4eec191befb4cc8fe91b560caa03a8ac5009080ef

Download Submit
\Users\Admin\AppData\Local\Temp\calc.exe

Filesize
89KB

MD5
29bac78bb5f8aa8c5c815f992928cfc6

SHA1
65be62c00365877a2d718ade5f8d78139abd9b83

SHA256
ddf6696f90a73e016c88f2915a73d00ee9bf2100b1f314857554d21892c9e477

SHA512
1605abbbdfd4b5a6d03fade5dc573940175f521986574cbc0e434c27e3cf79ec3b8eb06e135166b1dde90ad4eec191befb4cc8fe91b560caa03a8ac5009080ef

Download Submit
\Users\Admin\AppData\Local\Temp\calc.exe

Filesize
89KB

MD5
29bac78bb5f8aa8c5c815f992928cfc6

SHA1
65be62c00365877a2d718ade5f8d78139abd9b83

SHA256
ddf6696f90a73e016c88f2915a73d00ee9bf2100b1f314857554d21892c9e477

SHA512
1605abbbdfd4b5a6d03fade5dc573940175f521986574cbc0e434c27e3cf79ec3b8eb06e135166b1dde90ad4eec191befb4cc8fe91b560caa03a8ac5009080ef

Download Submit
memory/1696-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/1696-59-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1696-62-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download