8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54

Analysis

max time kernel
62s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54.exe
Size

102KB
MD5

01f3163740b37e688431b7f04d361a7f
SHA1

3e0f3f5d752a920c07c242c6ab80b6ad2cc4c9b8
SHA256

8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54
SHA512

716eb49f6492666ffd240095ab4e4822ad01b8cc59e1e1036f0a5c7cf97fcd54075f93f7a8108d132f777f2aa838c7f114cb2f8d832e1d6486da4460b29a7335
SSDEEP

3072:WnilMfONuXw6RuNDAsnHQA+Xk+jmL9lMg76t8:wilMmGwdAsHQPkb9l28

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
384	GammaHT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	384	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 384	400	8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54.exe	83
PID 400 wrote to memory of 384	400	8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54.exe	83
PID 400 wrote to memory of 384	400	8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54.exe	83

C:\Users\Admin\AppData\Local\Temp\8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54.exe
"C:\Users\Admin\AppData\Local\Temp\8f2bfb747d0c9bf404e7f3784a25ab4b89e802725447ec6570f3c5e649dcdf54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\GammaHT.exe
  C:\Users\Admin\AppData\Local\Temp\GammaHT.exe
  2⤵
  - Executes dropped EXE
  PID:384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 288
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 384 -ip 384
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GammaHT.exe

Filesize
48KB

MD5
b650423d6fc5b13b1376afcbc46d2f1e

SHA1
1339c5e2f31722dfe699c881d7f81acaa8693391

SHA256
fe98f2509ead8cd50a752453a2de3e493eaa9a322ade4374a955fcdf62374fbc

SHA512
3a66ccb6597769dc2fe197d976848232a7e745de005a368dcaed6fd90f3d1acd898323b5e27bc4ab76d137b50bb2860d5f8e4f74a50d030ffa49f6e487574259

Download Submit
C:\Users\Admin\AppData\Local\Temp\GammaHT.exe

Filesize
48KB

MD5
b650423d6fc5b13b1376afcbc46d2f1e

SHA1
1339c5e2f31722dfe699c881d7f81acaa8693391

SHA256
fe98f2509ead8cd50a752453a2de3e493eaa9a322ade4374a955fcdf62374fbc

SHA512
3a66ccb6597769dc2fe197d976848232a7e745de005a368dcaed6fd90f3d1acd898323b5e27bc4ab76d137b50bb2860d5f8e4f74a50d030ffa49f6e487574259

Download Submit
memory/384-132-0x0000000000000000-mapping.dmp

Download