b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc

Analysis

max time kernel
130s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.exe
Size

3.3MB
MD5

66beeee4940f585c6dc0abfe50cdbb4f
SHA1

39afc72cbb0e0a4873f5a19d6986aba784e310b7
SHA256

b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc
SHA512

eec376a13af5b1ca6172a61a03e3ae652578cb2ffca07740d8a9688cdafcbeda5aaa4b5c5886ee6c5bf500ca2374184acf6ef3863f2f38f96dc95ab37ec2200f
SSDEEP

98304:uNmYggSwUB9ArtfLJGu2LgeOA9qFnxUgzhAR:WmYggSwUB9GtfUu2LxqFn6gzhAR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4708	b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4708	4752	b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.exe	82
PID 4752 wrote to memory of 4708	4752	b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.exe	82
PID 4752 wrote to memory of 4708	4752	b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.exe	82

C:\Users\Admin\AppData\Local\Temp\b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.exe
"C:\Users\Admin\AppData\Local\Temp\b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\is-6PFAN.tmp\b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6PFAN.tmp\b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.tmp" /SL5="$701CA,3171599,53248,C:\Users\Admin\AppData\Local\Temp\b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.exe"
  2⤵
  - Executes dropped EXE
  PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-6PFAN.tmp\b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.tmp

Filesize
681KB

MD5
8e3e4508030c1ffdb0196309114eb841

SHA1
33656ec0c5b5ab8ce4ac566be0a95a96ec4ac40c

SHA256
6d9b3b086a0cd15c9fd32cf639c61e52d4d928d0112a7bb75e95f010e995dd2b

SHA512
6f16872abeb2de9ce3d881cf4b13778af03a305b068e99a8e59735bd4c13b5ad6f24a7aa44c2327cbfbb8351324ab85bb2157d719249fa29eb6f46061badffa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6PFAN.tmp\b7b5418e3fa2d0e8acf86c37331b896c6a5f4b50bc85c76af6b70663ac55c3cc.tmp

Filesize
681KB

MD5
8e3e4508030c1ffdb0196309114eb841

SHA1
33656ec0c5b5ab8ce4ac566be0a95a96ec4ac40c

SHA256
6d9b3b086a0cd15c9fd32cf639c61e52d4d928d0112a7bb75e95f010e995dd2b

SHA512
6f16872abeb2de9ce3d881cf4b13778af03a305b068e99a8e59735bd4c13b5ad6f24a7aa44c2327cbfbb8351324ab85bb2157d719249fa29eb6f46061badffa4

Download Submit
memory/4708-134-0x0000000000000000-mapping.dmp

Download
memory/4752-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4752-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download