d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00

Analysis

max time kernel
50s
max time network
61s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-03-2023 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00.exe
Size

1.4MB
MD5

788bb08e3afae7f5758baefc8a325fe7
SHA1

125dd6727897022284375959143e7efd814612be
SHA256

d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00
SHA512

8b4ad3ccf336755ad57dd33adf514ade27a442dadb2e8161fe6d9d39a11a3761f11d02944891413928aaa56fed681114b91d554f06b686e433fcc3582ebf411f
SSDEEP

24576:gJr8tE+gHqw1aCk23ExAbDBq0zNbbQ/oI6A0omFNqEAPL04VslE0cqHH29:gJ4NwEAbDtz6zV1gLAPQnEXqHO

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2724	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2724	3588	d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00.exe	66
PID 3588 wrote to memory of 2724	3588	d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00.exe	66
PID 3588 wrote to memory of 2724	3588	d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00.exe	66

C:\Users\Admin\AppData\Local\Temp\d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00.exe
"C:\Users\Admin\AppData\Local\Temp\d66046171a8cdebd3ee999cb775e891ae838238f8dd21d4471a4cdfac6a62a00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" 5AqOG4p.lAb /u /s
  2⤵
  - Loads dropped DLL
  PID:2724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5AqOG4p.lAb

Filesize
1.2MB

MD5
8b193f35819120ddf43dd82edc4ed689

SHA1
45f6b05cfe7a523f6021a50cff0a435e8dc2ea53

SHA256
d52fc8b24d38aed84d8b698fc99e7c6c0f52379f90d621ca0b1bae0744242a7c

SHA512
df05dc828d6fb41522c6df3510cbca09b6f640be7708b1a25d4e688f80c89426c12b3a8e304b4bc25732a7ccd6836aed3555e3658a71a1ee58ac239cd8ea43b2

Download Submit
\Users\Admin\AppData\Local\Temp\5AqOg4p.lab

Filesize
1.2MB

MD5
8b193f35819120ddf43dd82edc4ed689

SHA1
45f6b05cfe7a523f6021a50cff0a435e8dc2ea53

SHA256
d52fc8b24d38aed84d8b698fc99e7c6c0f52379f90d621ca0b1bae0744242a7c

SHA512
df05dc828d6fb41522c6df3510cbca09b6f640be7708b1a25d4e688f80c89426c12b3a8e304b4bc25732a7ccd6836aed3555e3658a71a1ee58ac239cd8ea43b2

Download Submit
memory/2724-125-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2724-127-0x0000000000BD0000-0x0000000000BD6000-memory.dmp

Filesize
24KB

Download
memory/2724-129-0x0000000004CD0000-0x0000000004DB6000-memory.dmp

Filesize
920KB

Download
memory/2724-130-0x0000000003390000-0x000000000345E000-memory.dmp

Filesize
824KB

Download
memory/2724-133-0x0000000003390000-0x000000000345E000-memory.dmp

Filesize
824KB

Download
memory/2724-134-0x0000000003390000-0x000000000345E000-memory.dmp

Filesize
824KB

Download