Analysis
-
max time kernel
18s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-09-2021 07:21
Static task
static1
Behavioral task
behavioral1
Sample
47000B94531AD6B652797C1F2E525752.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
47000B94531AD6B652797C1F2E525752.exe
Resource
win10v20210408
General
-
Target
47000B94531AD6B652797C1F2E525752.exe
-
Size
3.8MB
-
MD5
47000b94531ad6b652797c1f2e525752
-
SHA1
58de952fe5d182294e5e6d5141567b9ce61a331e
-
SHA256
6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d
-
SHA512
eb9795ad340d101c5d1412ed1206ff97ecb75ea79da3a3030e175d6d2926ab47e67944bd5e660b3e0c4f017f9b28f8ec7f7004a35a5c5446edf55dca7ec51dd4
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libzip.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libzip.dll aspack_v212_v242 -
Executes dropped EXE 2 IoCs
Processes:
setup.exesetup_install.exepid process 3212 setup.exe 3400 setup_install.exe -
Loads dropped DLL 5 IoCs
Processes:
setup_install.exepid process 3400 setup_install.exe 3400 setup_install.exe 3400 setup_install.exe 3400 setup_install.exe 3400 setup_install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
47000B94531AD6B652797C1F2E525752.exesetup.exesetup_install.exedescription pid process target process PID 564 wrote to memory of 3212 564 47000B94531AD6B652797C1F2E525752.exe setup.exe PID 564 wrote to memory of 3212 564 47000B94531AD6B652797C1F2E525752.exe setup.exe PID 564 wrote to memory of 3212 564 47000B94531AD6B652797C1F2E525752.exe setup.exe PID 3212 wrote to memory of 3400 3212 setup.exe setup_install.exe PID 3212 wrote to memory of 3400 3212 setup.exe setup_install.exe PID 3212 wrote to memory of 3400 3212 setup.exe setup_install.exe PID 3400 wrote to memory of 2856 3400 setup_install.exe cmd.exe PID 3400 wrote to memory of 2856 3400 setup_install.exe cmd.exe PID 3400 wrote to memory of 2856 3400 setup_install.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47000B94531AD6B652797C1F2E525752.exe"C:\Users\Admin\AppData\Local\Temp\47000B94531AD6B652797C1F2E525752.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\5350ad3bc3d6e68.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libzip.dllMD5
81d6f0a42171755753e3bc9b48f43c30
SHA1b766d96e38e151a6a51d72e753fb92687e8f9d03
SHA256e186cf97d768a139819278c4ce35e6df65adb2bdaee450409994d4c7c8d7c723
SHA512461bf23b1ec98d97281fd55308d1384a3f471d0a4b2e68c2a81a98346db9edc3ca2b8dbeb68ae543796f73cc04900ec298554b7ff837db0241863a157b43cda1
-
C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\setup_install.exeMD5
3e5ac1b22da85322de6702eaf6fe8e83
SHA12c955337303058323a0c3a51b0a656297c54405f
SHA2567b23b51b8325f3598cf9bc9ceb07ecdb791f30ce0fb215adeb7885f88863708f
SHA5121004d15f3fde645d7604a32b87c43bc46e11a82ab565941dac4165027b715cd593bd3684f5a97a5b0c11227b6935c24990cb86ced59b832e4cf7a0b566540e50
-
C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\setup_install.exeMD5
3e5ac1b22da85322de6702eaf6fe8e83
SHA12c955337303058323a0c3a51b0a656297c54405f
SHA2567b23b51b8325f3598cf9bc9ceb07ecdb791f30ce0fb215adeb7885f88863708f
SHA5121004d15f3fde645d7604a32b87c43bc46e11a82ab565941dac4165027b715cd593bd3684f5a97a5b0c11227b6935c24990cb86ced59b832e4cf7a0b566540e50
-
C:\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\zlib1.dllMD5
c7d4d685a0af2a09cbc21cb474358595
SHA1b784599c82bb90d5267fd70aaa42acc0c614b5d2
SHA256e96b397b499d9eaa3f52eaf496ca8941e80c0ad1544879ccadf02bf2c6a1ecfc
SHA512fed2c126a499fae6215e0ef7d76aeec45b60417ed11c7732379d1e92c87e27355fe8753efed86af4f58d52ea695494ef674538192fac1e8a2a114467061a108b
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
4cd455dae33b8d3ee0173eb11a6a281d
SHA10a99006dbabcf167e8309c8b56129bc9d559c524
SHA256bcc9d98b18e172b038a0f8a23e997f783349118f043c3a7de615d20794425db5
SHA512b8b6b6ca96a39186fad059763f8c1a0e5341eb105c7b1126dd2a1b7f7072e730d75656bd3f783cf2bde10cb5f2575efade97ee75473515c48f77f9d97fa2475a
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
4cd455dae33b8d3ee0173eb11a6a281d
SHA10a99006dbabcf167e8309c8b56129bc9d559c524
SHA256bcc9d98b18e172b038a0f8a23e997f783349118f043c3a7de615d20794425db5
SHA512b8b6b6ca96a39186fad059763f8c1a0e5341eb105c7b1126dd2a1b7f7072e730d75656bd3f783cf2bde10cb5f2575efade97ee75473515c48f77f9d97fa2475a
-
\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\libzip.dllMD5
81d6f0a42171755753e3bc9b48f43c30
SHA1b766d96e38e151a6a51d72e753fb92687e8f9d03
SHA256e186cf97d768a139819278c4ce35e6df65adb2bdaee450409994d4c7c8d7c723
SHA512461bf23b1ec98d97281fd55308d1384a3f471d0a4b2e68c2a81a98346db9edc3ca2b8dbeb68ae543796f73cc04900ec298554b7ff837db0241863a157b43cda1
-
\Users\Admin\AppData\Local\Temp\7zSC8CEA4B4\zlib1.dllMD5
c7d4d685a0af2a09cbc21cb474358595
SHA1b784599c82bb90d5267fd70aaa42acc0c614b5d2
SHA256e96b397b499d9eaa3f52eaf496ca8941e80c0ad1544879ccadf02bf2c6a1ecfc
SHA512fed2c126a499fae6215e0ef7d76aeec45b60417ed11c7732379d1e92c87e27355fe8753efed86af4f58d52ea695494ef674538192fac1e8a2a114467061a108b
-
memory/2856-134-0x0000000000000000-mapping.dmp
-
memory/3212-114-0x0000000000000000-mapping.dmp
-
memory/3400-132-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3400-129-0x0000000061880000-0x00000000618B7000-memory.dmpFilesize
220KB
-
memory/3400-117-0x0000000000000000-mapping.dmp
-
memory/3400-130-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3400-131-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3400-133-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB