750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615

Analysis

max time kernel
52s
max time network
66s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
26/04/2023, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615.exe
Size

5.1MB
MD5

de9f8bc2094bbcba06eac4aedc2844d5
SHA1

94d1aa466145b20b911e3b39e164aecdb1497e79
SHA256

750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615
SHA512

74e53848594954b4e5e82dcf7fe09adee199a5e2f1e52b248726e7936f60468639a703eef98a52809103e33441a218f4be583b7a59a5bfee8d9a73ddde2c9294
SSDEEP

98304:x+E1ot1sICUezb3Fa3A6LTm4Lo39KfXhjYmo4y7jJIW4M5DVZ3:xr8LslaZL/2mLGJIdMJV

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2484-121-0x00000000009E0000-0x00000000012A8000-memory.dmp	vmprotect
behavioral1/memory/2484-122-0x00000000009E0000-0x00000000012A8000-memory.dmp	vmprotect
behavioral1/memory/2484-125-0x00000000009E0000-0x00000000012A8000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2872	notepad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2872	2484	750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615.exe	66
PID 2484 wrote to memory of 2872	2484	750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615.exe	66
PID 2484 wrote to memory of 2872	2484	750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615.exe	66

C:\Users\Admin\AppData\Local\Temp\750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615.exe
"C:\Users\Admin\AppData\Local\Temp\750413dc8daeaa3c9db194c6e04921e7e6891c14e9d3e7834972c85a92715615.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\hwid.ini

Filesize
44B

MD5
299c4699fd7ca31055fa4ba90f5dfaeb

SHA1
1037cdf3bea09af88f3d9d4738947040bb5f7d02

SHA256
e030b583b9ec8472c8718a3777fbb5982500631fe004f668239328c5b663723f

SHA512
04e526c7a891835ba4583305dd993d33c70a1d3896ea299a7f056a46fde368be0e2c7a98f27798f6dbf5657d6987f47c2ae949b1e25797c02fe9bf8ead9bf70f

Download Submit
memory/2484-121-0x00000000009E0000-0x00000000012A8000-memory.dmp

Filesize
8.8MB

Download
memory/2484-122-0x00000000009E0000-0x00000000012A8000-memory.dmp

Filesize
8.8MB

Download
memory/2484-125-0x00000000009E0000-0x00000000012A8000-memory.dmp

Filesize
8.8MB

Download