aabe7544db1fafb380e21cc2d80c09b06c8d6b153d9badedeb5622add0d1cd97

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-en-20211014
submitted
25-10-2021 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
Size

362KB
MD5

d410cd964d3976d87860acc4f35a01c8
SHA1

8bd1bced5b6abc8e6802f1ddee328898d7dbdf65
SHA256

4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a
SHA512

394740c4ab964d3d6b667c54a54c8ae4411a4359a3ee2b68979486b38133c4e609e3554b01815aa9a27785d860adb3e50e84dc8dabf48a5150ac28e35bd13786

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

downloader.exeipfs.exeipfs.exedownloader.exe

pid process

1016 downloader.exe
288 ipfs.exe
1572 ipfs.exe
1376 downloader.exe

pid	process
1016	downloader.exe
288	ipfs.exe
1572	ipfs.exe
1376	downloader.exe

Loads dropped DLL 7 IoCs

Processes:

4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe

pid	process
668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exeipfs.exe

description	pid	process	target process
PID 668 wrote to memory of 1016	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 668 wrote to memory of 1016	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 668 wrote to memory of 1016	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 668 wrote to memory of 1016	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 668 wrote to memory of 288	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 288	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 288	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 288	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 1572	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 1572	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 1572	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 1572	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	ipfs.exe
PID 668 wrote to memory of 1376	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 668 wrote to memory of 1376	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 668 wrote to memory of 1376	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 668 wrote to memory of 1376	668	4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe	downloader.exe
PID 1572 wrote to memory of 1760	1572	ipfs.exe	route.exe
PID 1572 wrote to memory of 1760	1572	ipfs.exe	route.exe
PID 1572 wrote to memory of 1760	1572	ipfs.exe	route.exe
PID 1572 wrote to memory of 1760	1572	ipfs.exe	route.exe

C:\Users\Admin\AppData\Local\Temp\4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe
"C:\Users\Admin\AppData\Local\Temp\4a32ef4d911a823aaeac64664a8f9e28890bbd20da689580802e23d571d0f68a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\Temp\data\downloader.exe
"C:\Users\Admin\AppData\Local\Temp\data\downloader.exe" preferences-ips
2⤵
- Executes dropped EXE
PID:1016

C:\Users\Admin\AppData\Roaming\ipfs\ipfs.exe
"C:\Users\Admin\AppData\Roaming\ipfs\ipfs.exe" init
2⤵
- Executes dropped EXE
PID:288

C:\Users\Admin\AppData\Roaming\ipfs\ipfs.exe
"C:\Users\Admin\AppData\Roaming\ipfs\ipfs.exe" daemon
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\route.exe
route print 0.0.0.0
3⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\data\downloader.exe
"C:\Users\Admin\AppData\Local\Temp\data\downloader.exe" preferences-yt
2⤵
- Executes dropped EXE
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ipfs\blocks\L5\CIQBIQXZ4NWWDXUSIYSCX7RE6EBXHMGENZNMUDEMGNKMGT2K6LLUL5Y.data
MD5
e5ceda8228b5f5cf03dc480911bc3d14

SHA1
491cf9c0d333847bb6d625fc69bd39745100baff

SHA256
1442f9e36d61de9246242bfe24f10373b0c46e5aca0c8c3354c34f4af2d745f7

SHA512
d22211a5c55a26b11fd287fa9532dd226ab65a5e72930c9f8802ed8a655607afdbe63aa476963e0581cc5a5e5dc2dc37ffe0f8d069a7fb46e40b7988671c8d42

Download Submit
C:\Users\Admin\.ipfs\blocks\N2\CIQDWKPBHXLJ3XVELRJZA2SYY7OGCSX6FRSIZS2VQQPVKOA2Z4VXN2I.data
MD5
d1c3b632bb05d58fe6c1ab061b38ac2a

SHA1
e93e8525510de01168a842f918a69e388c5dc8d2

SHA256
3b29e13dd69ddea45c53906a58c7dc614afe2c648ccb55841f55381acf2b76e9

SHA512
89ec053962a115d40a281f3a4cb3e74f01d7d3e125ca7eb5d16a1d19f9b256c0d70dfea064724d8de413825328997bfdc71655831f12eb9513de68215d9bea2c

Download Submit
C:\Users\Admin\.ipfs\blocks\PM\CIQKNNRB2NFYXUZDJ2UWNMSKYLGTKUYDRQTJCDI7JTUDFH6YOYNUPMA.data
MD5
70a5a06cfef7dfbd5149425eb369ad0f

SHA1
83c42e8bcbcba098ae15c17f8c0c112cd148765b

SHA256
a6b621d34b8bd3234ea966b24ac2cd3553038c26910d1f4ce8329fd8761b47b0

SHA512
0fdb30a4ae5cbca15ea07bf763211a68a9853ec756d8bf0eb5fc83534f2a30da10255782e57fa34dc40a9cd54275f2d179c4d5b0db109803d6a8a95ff19022e4

Download Submit
C:\Users\Admin\.ipfs\blocks\SHARDING
MD5
d713ff4594563267cab170596493dea3

SHA1
9ce016fb4dc32ee86c3f7e0d738679345bbe7d6a

SHA256
70fb6665a8db5fcc035e93750fe34b5a001a69bbde676ebcf64665c4a5876d58

SHA512
30d551e35b9c810d88179b8c81385f8c1a2bff12817337c9cf6f555158a9a8a39cc0b221431be83c21f5193dd5210740a141370ddfff0ba79f6d6a1125d39a4c

Download Submit
C:\Users\Admin\.ipfs\blocks\_README
MD5
35ad9a49218542e6a42b00ddfb944363

SHA1
d5029fa77bd02d4f4088413ff3d661fb89af0df9

SHA256
46d5d0498e45d09fd77030a4f47c059477c4967c55b6a31d4eef8c94d086dfad

SHA512
fc8e52c6d03209e7367f92048c06f57835a939d8bbac101f53ffe5c7b4a21ea3ca692278a15139f8549bdb2c55a38c95e915c9a4688a483183de125f7b61c9cb

Download Submit
C:\Users\Admin\.ipfs\blocks\diskUsage.cache
MD5
4b5a4d351b793b2237e78a341c9c1356

SHA1
31438deca1d9665da1deeb4007125883a1d89a2b

SHA256
d5bbae038bdd4df108b65b09626c7ecd7c4249a26ff48cba8ff746eb249e2c99

SHA512
f1eaebe4af69efe120a70ea4aa20a8d75140424d84e44c56aaee9c1d5b2d44a7571f2efcbc3aac9a0b0a0d5ea50e7d1530414c89af8d959274a8e77bb72570c5

Download Submit
C:\Users\Admin\.ipfs\config
MD5
9dc17b47dbf6b34fa114aaecf90fb645

SHA1
05b4450f16801792307512f77b89f123ff20a5f8

SHA256
77ca1b556b512f3410c203ef9e1cd00abfed888e317e39942b2890a5551b5c9c

SHA512
840cca39fd29eb3a91148f9427a937f5150e5d388567c5f115aaa0f64c8bf9b1e2c357ac44b9a105aa8371c11176b020f10df26a8cf0bfbe5c5b0295647adcf1

Download Submit
C:\Users\Admin\.ipfs\datastore\000002.ldb
MD5
867bab323a6b0356d762621e7cee4ea6

SHA1
3fcac7f7dfbf565a340ad4c3550eb577033745e1

SHA256
90c8afbad2aa860e1638c0bc341eb8712bb1f7c9452ffb75bac83d7f9fbd91e0

SHA512
0273a7a388757b6fda2630cf84edc9de680d61b17dea6f516b8f16da54d4ac43e318ad5aa2d97caf5a391463adb26eca55f953c8953c301893883a4eb3d4bc68

Download Submit
C:\Users\Admin\.ipfs\datastore\000003.log
MD5
bb0e8d0e66ce3cb4f6090c4af587f83f

SHA1
4f76565d35b69e2705968c2c4c7541ce245ff492

SHA256
042d5c00ee1412e4a4cd64510b945e4ae316ee3ec85a6a15f75ef6bb7497425b

SHA512
01c536180546184eb789a02ad09d7bacef07f4d530c423f1aeca34eacff551ddf2199a5dc2bad9bb20950e39185b4cded2407ac604708e125f963c15443c9da0

Download Submit
C:\Users\Admin\.ipfs\datastore\CURRENT
MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\.ipfs\datastore\CURRENT.bak
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\.ipfs\datastore\LOG
MD5
cd946cf4820f0ee343791d6181e28899

SHA1
20e14ebc1d2ec86711650d166c16e15f1fdd5561

SHA256
fa8d59168c6e5272ea6fd6d283d5bf0c88bd64b75147a06d5c73dffddd099ba9

SHA512
e71676598ef678447bdc8cb8d99cbeccc0bb749e1801cde87708f89e3ce9c341a673a685cdee3224fbcfcff043fb66c15413ef38dad305c873212a07932a102e

Download Submit
C:\Users\Admin\.ipfs\datastore\MANIFEST-000004
MD5
2db88d28d0931eebf5e622cb716c1b39

SHA1
ea9f9183dce7f1a555556a0d7ba1f596e6a7410c

SHA256
f6cf2708d0394528e6171eecc3bce50fdd4ced44a41f0a0e48af21b0b9daf123

SHA512
d34e97d61e714cf99dce6ad97e335a3020b2b163910c753cabbf487f5b8e8f770ff71ff3c7b3fd0177de200bd63aa89ef7bf2a670a4461ef9b2d94e6192308fb

Download Submit
C:\Users\Admin\.ipfs\datastore_spec
MD5
9a9e40d83ab16950daa61f5ab536b77c

SHA1
f9f5fa0ab6f17688d6445a0502a81f093fb08d6c

SHA256
cb1f1e3c29472474de76bb5210dcd3f2500e91c8d88e3a709d519a754ee2eb6e

SHA512
6115c36d3112780c723bb9b1ddcd7ba255adcb8d905941fa3023004276c8a677d8bec4c5db24f873e054cc951cd8fdb9d235e2947adfa6aa9e9ed735e86bb42a

Download Submit
C:\Users\Admin\.ipfs\version
MD5
84bc3da1b3e33a18e8d5e1bdd7a18d7a

SHA1
d3964f9dad9f60363c81b688324d95b4ec7c8038

SHA256
10159baf262b43a92d95db59dae1f72c645127301661e0a3ce4e38b295a97c58

SHA512
61561e09d4cd2834f3714030c96f29d6aa16e7ab35051c91adbfdf3ee90bad5c2cb685d68e576325d16f521808ad560fa67ca0514905642ea3419e974d5e5893

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
2c4c72c31568e6a599de2a0e5dd1cc1e

SHA1
47ba3fdbf2e77899bc2a863a2c26ae60e485e4ba

SHA256
f9d4297b3e63173a27cd22aa077ff9af519813ad066b8178ffd74b81fe369f67

SHA512
cf4f29613d6a16befac57dbfb216e91c75cbe3b16c0efe244231c826f50c9419f6d06418b7253adff7a5d33c930dce6b7dd8ac3a455e4d2807d70137cf849ca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
2c4c72c31568e6a599de2a0e5dd1cc1e

SHA1
47ba3fdbf2e77899bc2a863a2c26ae60e485e4ba

SHA256
f9d4297b3e63173a27cd22aa077ff9af519813ad066b8178ffd74b81fe369f67

SHA512
cf4f29613d6a16befac57dbfb216e91c75cbe3b16c0efe244231c826f50c9419f6d06418b7253adff7a5d33c930dce6b7dd8ac3a455e4d2807d70137cf849ca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\go-ipfs_v0.4.21_windows-386.zip
MD5
0623404982399341c3e8f62a5ad4dc36

SHA1
8430fbd30df64ba5c90ee3fb1774a1ed65f97cb5

SHA256
07731d13dfc46c023eeef7c5aedba954932f38824a1512f9f428eaf9fa89599b

SHA512
2be00aea7ecfc8bee014de820af4db1db706156c1c911217cec2867117de707a4f5ca4a53998389703be55271f30c53c29e33649db30b1490d47ea8f28f8052d

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\preferences-ips
MD5
9c92c29702d2a721b7e597a9399608d0

SHA1
34001260827b6023f1703185cbf51a39182bdd59

SHA256
89a9101c104bcc0b9d5875193438ebf1a16e4e41e4ab02943a7ff1a4c088ec5d

SHA512
2c5e93df10f858cb576985c4c183da92dacfd071b2d9397b672ac5c2a81454dd0cafa364887e450dcc69372fb8872fdd3298051553f1f7d54a91919f0d051860

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\preferences-yt
MD5
7ef7a739de5a36397d8f203d5e6ccd12

SHA1
8924e0f41e9248c0cbafdf936eae20f7b602cb56

SHA256
e5c914f48ed8182f623751142c1cb338ff1c07d60a345536a5ca4aa5e972d8ab

SHA512
277f0560b6a5ba169e8717e8be901a2d2c8b40e7329288cc1e5900a931aea2c26eb49da778c094583b4200894cd46b14fd51571f4d557e9e5ea12cd302aa8161

Download Submit
C:\Users\Admin\AppData\Roaming\ipfs\ipfs.exe
MD5
0f5fc5c4bb5b72464a54d6e36f1a1815

SHA1
b04a446d98bd9428f5a8a1eea742d0437631494f

SHA256
db1fdb281050c07b243d0ec79c25b3bab550cad64f140dedbb1f307aee1fec5b

SHA512
1a1bf10424e241cefca698308fc27414e81b09da395b6fdd9320697a8a6af651e910d46b00a325afcd9534fe9f339ece4f4928e7ee5f317e791954b2330552ca

Download Submit
C:\Users\Admin\AppData\Roaming\ipfs\ipfs.exe
MD5
0f5fc5c4bb5b72464a54d6e36f1a1815

SHA1
b04a446d98bd9428f5a8a1eea742d0437631494f

SHA256
db1fdb281050c07b243d0ec79c25b3bab550cad64f140dedbb1f307aee1fec5b

SHA512
1a1bf10424e241cefca698308fc27414e81b09da395b6fdd9320697a8a6af651e910d46b00a325afcd9534fe9f339ece4f4928e7ee5f317e791954b2330552ca

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
2c4c72c31568e6a599de2a0e5dd1cc1e

SHA1
47ba3fdbf2e77899bc2a863a2c26ae60e485e4ba

SHA256
f9d4297b3e63173a27cd22aa077ff9af519813ad066b8178ffd74b81fe369f67

SHA512
cf4f29613d6a16befac57dbfb216e91c75cbe3b16c0efe244231c826f50c9419f6d06418b7253adff7a5d33c930dce6b7dd8ac3a455e4d2807d70137cf849ca8

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
2c4c72c31568e6a599de2a0e5dd1cc1e

SHA1
47ba3fdbf2e77899bc2a863a2c26ae60e485e4ba

SHA256
f9d4297b3e63173a27cd22aa077ff9af519813ad066b8178ffd74b81fe369f67

SHA512
cf4f29613d6a16befac57dbfb216e91c75cbe3b16c0efe244231c826f50c9419f6d06418b7253adff7a5d33c930dce6b7dd8ac3a455e4d2807d70137cf849ca8

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
2c4c72c31568e6a599de2a0e5dd1cc1e

SHA1
47ba3fdbf2e77899bc2a863a2c26ae60e485e4ba

SHA256
f9d4297b3e63173a27cd22aa077ff9af519813ad066b8178ffd74b81fe369f67

SHA512
cf4f29613d6a16befac57dbfb216e91c75cbe3b16c0efe244231c826f50c9419f6d06418b7253adff7a5d33c930dce6b7dd8ac3a455e4d2807d70137cf849ca8

Download Submit
\Users\Admin\AppData\Local\Temp\data\downloader.exe
MD5
2c4c72c31568e6a599de2a0e5dd1cc1e

SHA1
47ba3fdbf2e77899bc2a863a2c26ae60e485e4ba

SHA256
f9d4297b3e63173a27cd22aa077ff9af519813ad066b8178ffd74b81fe369f67

SHA512
cf4f29613d6a16befac57dbfb216e91c75cbe3b16c0efe244231c826f50c9419f6d06418b7253adff7a5d33c930dce6b7dd8ac3a455e4d2807d70137cf849ca8

Download Submit
\Users\Admin\AppData\Roaming\ipfs\ipfs.exe
MD5
0f5fc5c4bb5b72464a54d6e36f1a1815

SHA1
b04a446d98bd9428f5a8a1eea742d0437631494f

SHA256
db1fdb281050c07b243d0ec79c25b3bab550cad64f140dedbb1f307aee1fec5b

SHA512
1a1bf10424e241cefca698308fc27414e81b09da395b6fdd9320697a8a6af651e910d46b00a325afcd9534fe9f339ece4f4928e7ee5f317e791954b2330552ca

Download Submit
\Users\Admin\AppData\Roaming\ipfs\ipfs.exe
MD5
0f5fc5c4bb5b72464a54d6e36f1a1815

SHA1
b04a446d98bd9428f5a8a1eea742d0437631494f

SHA256
db1fdb281050c07b243d0ec79c25b3bab550cad64f140dedbb1f307aee1fec5b

SHA512
1a1bf10424e241cefca698308fc27414e81b09da395b6fdd9320697a8a6af651e910d46b00a325afcd9534fe9f339ece4f4928e7ee5f317e791954b2330552ca

Download Submit
\Users\Admin\AppData\Roaming\ipfs\ipfs.exe
MD5
0f5fc5c4bb5b72464a54d6e36f1a1815

SHA1
b04a446d98bd9428f5a8a1eea742d0437631494f

SHA256
db1fdb281050c07b243d0ec79c25b3bab550cad64f140dedbb1f307aee1fec5b

SHA512
1a1bf10424e241cefca698308fc27414e81b09da395b6fdd9320697a8a6af651e910d46b00a325afcd9534fe9f339ece4f4928e7ee5f317e791954b2330552ca

Download Submit
memory/288-64-0x0000000000000000-mapping.dmp

Download
memory/668-55-0x0000000074A41000-0x0000000074A43000-memory.dmp

Filesize
8KB

Download
memory/1016-58-0x0000000000000000-mapping.dmp

Download
memory/1376-71-0x0000000000000000-mapping.dmp

Download
memory/1572-67-0x0000000000000000-mapping.dmp

Download
memory/1760-88-0x0000000000000000-mapping.dmp

Download