5c5c3747d7ace4b8a38568fecc6e1da7acec0e365ee78ff885470356ad5ea1da

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13/01/2023, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fd90fe5fb7e102df4418b85bccd15b5.exe
Size 2.6MB
Sample230113-va4jcaed3s
SHA256 5c5c3747d7ace4b8a38568fecc6e1da7acec0e365ee78ff885470356ad5ea1da
MD5 4fd90fe5fb7e102df4418b85bccd15b5
SHA1 0890ff66f17f0b41f59dc9e53369ed88ca8318ed
SHA512 1bbdad274643feb1fe008b1d51e0427a31c3ba5a19981b832bb06f8fac02f0c36d6f35915585545173e2adbf3cc3d1e24ceca10aed5736c48a1ed9215e95ccdb
SSDEEP 49152:kdLvvuND6JcUu0XYoLXN16aUvpnmgieLt/EhA8nFJ5QVa/o:eDvuZF0BRkaUvpnmJet/J8b5Q4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
848	notepad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 848	1744	4fd90fe5fb7e102df4418b85bccd15b5.exe	28
PID 1744 wrote to memory of 848	1744	4fd90fe5fb7e102df4418b85bccd15b5.exe	28
PID 1744 wrote to memory of 848	1744	4fd90fe5fb7e102df4418b85bccd15b5.exe	28
PID 1744 wrote to memory of 848	1744	4fd90fe5fb7e102df4418b85bccd15b5.exe	28

C:\Users\Admin\AppData\Local\Temp\4fd90fe5fb7e102df4418b85bccd15b5.exe
"C:\Users\Admin\AppData\Local\Temp\4fd90fe5fb7e102df4418b85bccd15b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwid.ini

Path C:\hwid.ini
Size 44B
SHA256 7e2d8f2892e9b5b0b5bb6a314209703b0e5b03dbac2d6a5b0556953bc05c22cf
MD5 0d26838f817979af825fa5dba7e2076a
SHA1 f46cead6ff964e0f1fd8e46aa8e491278a5e55c4
SHA512 38061fd1d9a0e854a11144356bf35f076cd8f986ea576826741f78cc615b836ee8d5f5d343a75709b8f2c72c38dc8a1c1a769376863a772be69b974d7bbdedbe
MD5 SHA1 SHA512

Submit Download

memory/1744-54-0x0000000076531000-0x0000000076533000-memory.dmp

Download