be7331dd3b9faf80763ec2f18febca7a0ec296b7c97384d753ed6c74d0969fc7

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/01/2023, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a8b6f8cb475573b90e11a72e4670476.exe
Size 2.6MB
Sample230102-jqdr3sdf79
SHA256 be7331dd3b9faf80763ec2f18febca7a0ec296b7c97384d753ed6c74d0969fc7
MD5 4a8b6f8cb475573b90e11a72e4670476
SHA1 d7a29005694e0b388e9e665550df934a14485066
SHA512 6a7f712bbbce0da4a5020790bea28860325f372bcad8fdce9d51a33c33b822dd657300863a5dac85d5c57ffe1a466f8fb2be4e82290ac00219ab757ea42fc83e
SSDEEP 49152:sb34dHpTJgRBHVcyaSPNVssisGOk4LQkSJf6RhrZKa:s3oECDSPNVssisGOZQ7fK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
764	notepad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 764	1504	4a8b6f8cb475573b90e11a72e4670476.exe	28
PID 1504 wrote to memory of 764	1504	4a8b6f8cb475573b90e11a72e4670476.exe	28
PID 1504 wrote to memory of 764	1504	4a8b6f8cb475573b90e11a72e4670476.exe	28
PID 1504 wrote to memory of 764	1504	4a8b6f8cb475573b90e11a72e4670476.exe	28

C:\Users\Admin\AppData\Local\Temp\4a8b6f8cb475573b90e11a72e4670476.exe
"C:\Users\Admin\AppData\Local\Temp\4a8b6f8cb475573b90e11a72e4670476.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwid.ini

Path C:\hwid.ini
Size 44B
SHA256 1950a4a00bf8076aeadaceb0d6b970efe961a2f4585e0f21a910cea252a72a63
MD5 90791cefe2622cbbb4b0a50c6822700d
SHA1 6c5ecd103b5b519a618cf715bae8ff7515d26159
SHA512 fe679d52408489c7ea2b525faeec400f8b8b32d60f5e1c214d9b2626849252444ba32cc8e527d581c658dbb6156799ef20f5302a2140db6ae55e372d54c724a3
MD5 SHA1 SHA512

Submit Download

memory/1504-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Download