9e73fbc799272df3a85b6ef77894b061d91e5214a67ed2f1dd8b91f981b57ac5

Analysis

max time kernel
50s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/02/2023, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RR.lnk
Size 1KB
Sample230223-jbj1jsfa99
SHA256 0de89af6fa556b786c8de96fb3cfe96307ce8d8a14cef1fb6ca2f0d9e56be9b0
MD5 40c516687897e29cc967eaafd7355a64
SHA1 a68ca9733941ab3501a9c9baef7ec58587e79a45
SHA512 c23f88250532be801990b104d3e32ea8d3e4a55a20478599cbad9103d110c014156cd6b71fe262bea14d968fa71cc1b8ae7cf334a0df27bb887392ef31dbfa52
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
524	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 524	1048	cmd.exe	28
PID 1048 wrote to memory of 524	1048	cmd.exe	28
PID 1048 wrote to memory of 524	1048	cmd.exe	28
PID 1048 wrote to memory of 524	1048	cmd.exe	28
PID 524 wrote to memory of 912	524	cmd.exe	33
PID 524 wrote to memory of 912	524	cmd.exe	33
PID 524 wrote to memory of 912	524	cmd.exe	33
PID 524 wrote to memory of 912	524	cmd.exe	33
PID 524 wrote to memory of 912	524	cmd.exe	33
PID 524 wrote to memory of 912	524	cmd.exe	33
PID 524 wrote to memory of 912	524	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RR.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe" /q /c vibrations\\floodlight.cmd
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Users\Admin\AppData\Local\Temp\vibrations\circlets.exe
    vibrations\circlets.exe -decode vibrations\snows.sql c:\users\public\output.txt
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\vibrations\circlets.exe
    "C:\Users\Admin\AppData\Local\Temp\vibrations\circlets.exe" -decode vibrations\snows.sql c:\users\public\output.txt
    3⤵
    PID:648
- - C:\Users\Admin\AppData\Local\Temp\vibrations\circlets.exe
    vibrations\circlets.exe -decode c:\users\public\output.txt c:\users\public\output2.txt
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\vibrations\circlets.exe
    "C:\Users\Admin\AppData\Local\Temp\vibrations\circlets.exe" -decode c:\users\public\output.txt c:\users\public\output2.txt
    3⤵
    PID:2032
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 c:\users\public\output2.txt,N115
    3⤵
    PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-125-0x00000000023A0000-0x00000000023A1000-memory.dmp

Download

memory/524-158-0x00000000023A0000-0x00000000023A1000-memory.dmp