Overview
overview
10Static
static
107zS850A099...ed.exe
windows7_x64
107zS850A099...ed.exe
windows10-2004_x64
107zS850A099...1a.exe
windows7_x64
107zS850A099...1a.exe
windows10-2004_x64
17zS850A099...b7.exe
windows7_x64
107zS850A099...b7.exe
windows10-2004_x64
107zS850A099...5e.exe
windows7_x64
107zS850A099...5e.exe
windows10-2004_x64
107zS850A099...a0.exe
windows7_x64
107zS850A099...a0.exe
windows10-2004_x64
107zS850A099...95.exe
windows7_x64
77zS850A099...95.exe
windows10-2004_x64
77zS850A099...cb.exe
windows7_x64
107zS850A099...cb.exe
windows10-2004_x64
17zS850A099...58.exe
windows7_x64
77zS850A099...58.exe
windows10-2004_x64
17zS850A099...7f.exe
windows7_x64
77zS850A099...7f.exe
windows10-2004_x64
17zS850A099...32.exe
windows7_x64
77zS850A099...32.exe
windows10-2004_x64
77zS850A099...c3.exe
windows7_x64
87zS850A099...c3.exe
windows10-2004_x64
87zS850A099...e9.exe
windows7_x64
67zS850A099...e9.exe
windows10-2004_x64
67zS850A099...8c.exe
windows7_x64
87zS850A099...8c.exe
windows10-2004_x64
17zS850A099...8c.exe
windows7_x64
107zS850A099...8c.exe
windows10-2004_x64
107zS850A099...ll.exe
windows7_x64
107zS850A099...ll.exe
windows10-2004_x64
1Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-01-2022 08:10
Behavioral task
behavioral1
Sample
7zS850A099E/61e74fd2175cb_Tue23956aa60ed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7zS850A099E/61e74fd2175cb_Tue23956aa60ed.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
7zS850A099E/61e74fd3252fe_Tue23df2ad021a.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
7zS850A099E/61e74fd3252fe_Tue23df2ad021a.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
7zS850A099E/61e74fd41f841_Tue2365aa82b7.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
7zS850A099E/61e74fd41f841_Tue2365aa82b7.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral7
Sample
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral9
Sample
7zS850A099E/61e74fd78769f_Tue234b6c24d9a0.exe
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
7zS850A099E/61e74fd78769f_Tue234b6c24d9a0.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral11
Sample
7zS850A099E/61e74fd8ef830_Tue23593425095.exe
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
7zS850A099E/61e74fd8ef830_Tue23593425095.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral13
Sample
7zS850A099E/61e74fda51500_Tue23260baecb.exe
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
7zS850A099E/61e74fda51500_Tue23260baecb.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
7zS850A099E/61e7501ab629f_Tue23c4645058.exe
Resource
win7-en-20211208
Behavioral task
behavioral16
Sample
7zS850A099E/61e7501ab629f_Tue23c4645058.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
7zS850A099E/61e7501b7eabe_Tue2344597f.exe
Resource
win7-en-20211208
Behavioral task
behavioral18
Sample
7zS850A099E/61e7501b7eabe_Tue2344597f.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
7zS850A099E/61e7501c830d6_Tue23bdf4712a32.exe
Resource
win7-en-20211208
Behavioral task
behavioral20
Sample
7zS850A099E/61e7501c830d6_Tue23bdf4712a32.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral21
Sample
7zS850A099E/61e7501db65f3_Tue23c7b395c3.exe
Resource
win7-en-20211208
Behavioral task
behavioral22
Sample
7zS850A099E/61e7501db65f3_Tue23c7b395c3.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral23
Sample
7zS850A099E/61e7502b8389b_Tue233252e9.exe
Resource
win7-en-20211208
Behavioral task
behavioral24
Sample
7zS850A099E/61e7502b8389b_Tue233252e9.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral25
Sample
7zS850A099E/61e7502c4cff3_Tue232cba58c.exe
Resource
win7-en-20211208
Behavioral task
behavioral26
Sample
7zS850A099E/61e7502c4cff3_Tue232cba58c.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral27
Sample
7zS850A099E/61e7502f007f3_Tue23d6fecf8c.exe
Resource
win7-en-20211208
Behavioral task
behavioral28
Sample
7zS850A099E/61e7502f007f3_Tue23d6fecf8c.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
7zS850A099E/setup_install.exe
Resource
win7-en-20211208
Behavioral task
behavioral30
Sample
7zS850A099E/setup_install.exe
Resource
win10v2004-en-20220113
General
-
Target
7zS850A099E/61e74fd8ef830_Tue23593425095.exe
-
Size
1.6MB
-
MD5
c4e681d218d1c9c4efe701b4c7554eb5
-
SHA1
c3b43d0fbc5ad442067546b9d40c16810bb379da
-
SHA256
825a970bd11d349ba089e70419036c01ebb8cfd06e4abbec6bf58e9c7566a5e6
-
SHA512
b8d4ee6093835b0ec398f8884097db0bf1026e581743151241fb1489b061ba463dacf35b9af17f49ddc9d22769e9ebd763d9bfdb7e4d99e47a4e256c493ba3b5
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
rundll32.exepid process 1488 rundll32.exe 1488 rundll32.exe 1488 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 1488 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
61e74fd8ef830_Tue23593425095.execontrol.exedescription pid process target process PID 1916 wrote to memory of 732 1916 61e74fd8ef830_Tue23593425095.exe control.exe PID 1916 wrote to memory of 732 1916 61e74fd8ef830_Tue23593425095.exe control.exe PID 1916 wrote to memory of 732 1916 61e74fd8ef830_Tue23593425095.exe control.exe PID 1916 wrote to memory of 732 1916 61e74fd8ef830_Tue23593425095.exe control.exe PID 732 wrote to memory of 1488 732 control.exe rundll32.exe PID 732 wrote to memory of 1488 732 control.exe rundll32.exe PID 732 wrote to memory of 1488 732 control.exe rundll32.exe PID 732 wrote to memory of 1488 732 control.exe rundll32.exe PID 732 wrote to memory of 1488 732 control.exe rundll32.exe PID 732 wrote to memory of 1488 732 control.exe rundll32.exe PID 732 wrote to memory of 1488 732 control.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd8ef830_Tue23593425095.exe"C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd8ef830_Tue23593425095.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\G1V6MSEY.nr2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\G1V6MSEY.nr3⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\G1V6MSEY.nrMD5
5833d1af3c051231edc6bb9fc58bc81e
SHA1b86ad55d34da914eea5d38066d42b23a88196c40
SHA256de7810ca5d42e369822bddafe2da5fbba082b4aa72e42d754965fa627985c059
SHA512678783d326866c15750389992a61e1ce36770ef2700db4ecc0ea97233489029ba8426bc92b75e6882738da68c6f0d7efee28cd1cd8086198e687f7ae42104058
-
\Users\Admin\AppData\Local\Temp\G1V6MSEY.nrMD5
e23c9c12fa2606d1fdec5aaadbad1394
SHA150be3380f8f8632933e0246261bc8b7311b9bf60
SHA2569d6b710539f45ee5aa5d1a54a76f5c7a7768eb7d60c5bc055f842f144ee1859a
SHA51265c3eb4183565b32b0407cb4e0ae2e4bd16ac86984ec82574a7994009191994a5c5c4fd2d2303d6f2eea8a1c990e4eeb53def294d31e44f3360691608b0baf38
-
\Users\Admin\AppData\Local\Temp\G1V6MSEY.nrMD5
7d87ed55a79e00508cb6e5e55ccbe5fb
SHA113cad2c8bb4f106ade7de6e0ecee0d352d97fc16
SHA2569d0f9c35e2710586177d36f6542ad03038bd9ee55b00068f370147a36eb0f7ed
SHA512e537f578bdd280e4368eca6cafb1e53836bca50fdcadfc273d8b7bec86cb3b6eb6053038c62edcbfe0b81c94ce770040421e6dce76ff65fc3489ad9d806992d3
-
\Users\Admin\AppData\Local\Temp\G1V6MSEY.nrMD5
d7f92a486bd9c65871288cbd14bc4430
SHA1c70b87bb6d7325331c5d3ae20c3a409775a7b8c9
SHA25628b1b1175387e3add1ef6facc53d4adb6b6de20bd68ebda1f042511f82c6760a
SHA51262504a63bec75eb2cbab348fe7c1b42fd1368b7d5171b0d2ee69f4aff757f1d5996aae04e10dfcdfea2402378051bd9f1f57f6da47817e533b9576f84c44c9ae
-
memory/1916-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB