bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d

Analysis

max time kernel
62s
max time network
92s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe
Size

113KB
MD5

ef9965142656fa38bbe8c527c49c7fda
SHA1

0e1f4067fbe7c70ed4c07ec90c211ceea5b7cded
SHA256

bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d
SHA512

9600b4c75ccefb03cbf2ff04eaeb5c60c00342dba782394a4484aaa7e598dce9b99c09c83384d7617f7dafb6d1b536ee92a8116ce45743b204707447b75724b0
SSDEEP

3072:oirat2b/8fnrxMcfm7PHmzOOU+McCNXHFh:oZScOOOJ7cSX

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1708	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1812	bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1708	1812	bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe	28
PID 1812 wrote to memory of 1708	1812	bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe	28
PID 1812 wrote to memory of 1708	1812	bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe	28
PID 1812 wrote to memory of 1708	1812	bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe	28

C:\Users\Admin\AppData\Local\Temp\bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe
"C:\Users\Admin\AppData\Local\Temp\bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Vhp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Vhp..bat

Filesize
274B

MD5
d810781d100464aa88929066733882ad

SHA1
fde6a28f414dcab8702fee12b9d885f69b0d79d0

SHA256
7d7814704dad948a306d2f270cc2d3b0211d3b2bd704d3d11d70c8e377c9c870

SHA512
90c61e2e79da9e7a06e8083f46c0b49002fc1c2823ed01cebb58e3e530d64298d6200caafa1615e5fc70b48a19f086646ec1302306279118b32cdc3f8a7997b2

Download Submit
memory/1812-54-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1812-55-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download
memory/1812-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1812-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download