79798cd455143c5f2a6f70b87bd3e7b05ce5f68ee39409da1b4480c1842f842e

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/03/2023, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.7MB
Sample230327-r36bvsga3w
SHA256 79798cd455143c5f2a6f70b87bd3e7b05ce5f68ee39409da1b4480c1842f842e
MD5 8f9dd1bddf4d5f744a68ff41f2e66584
SHA1 85b60f054c2f86c71b494ed5c2db003ab4e8e731
SHA512 9d6272eb78943820aef3081ce1a63e9c75439f7238f14237c853faf36b9d848bcd1894d572e49498a6e795fd52f88de22d3908cc8e6e601fedafe724668d3902
SSDEEP 49152:VN8HBrq0eKtmrma5wB7Uzq+UVhsuAYfzgGele5wDUQ/Vh:P8H1qBYIzq+UVhsuAEYle5q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
580	notepad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 580	1528	file.exe	28
PID 1528 wrote to memory of 580	1528	file.exe	28
PID 1528 wrote to memory of 580	1528	file.exe	28
PID 1528 wrote to memory of 580	1528	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwid.ini

Path C:\hwid.ini
Size 44B
SHA256 a0e7756936fe82dfdee42fdf28bd4452aa99003d22595eccb82babb10ff842a6
MD5 640e14eff22036d73bad48aa34248481
SHA1 7403d789329fb156c86af348004d4fac2468b93a
SHA512 2587febd16bf89e84340fe96462adc0c7003c0d878580b00fd7da7cf736203256e152e6a60bd5851cf3f46e671bb2137fce1f1c5936ad40d4d91de89dd867cd2
MD5 SHA1 SHA512

Submit Download