ccc6a5077b55f9c96e1bb37bd963ffa1586764f74ae0431bb13e97aab099e0fe

Resubmissions

06-04-2022 17:56

220406-whze2agbf9 8

06-04-2022 17:48

220406-wdr56acgbr 8

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220331-en
submitted
06-04-2022 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B9B8BC0D8669C6E55F651DCA76E9A1A9.exe
Size

15.7MB
MD5

b9b8bc0d8669c6e55f651dca76e9a1a9
SHA1

1f59d1d5501b5d5a9417b56a09b9d34cc6375a6d
SHA256

ccc6a5077b55f9c96e1bb37bd963ffa1586764f74ae0431bb13e97aab099e0fe
SHA512

0f88efdd16ffb7faf4ca415179dd78ddcb0e2974eda7f3748f76291826c189e53587019c365a7b157e9c4a283cf6f3536666822d55f9ff20f521036a9ff7a15f

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

is-RJSE7.tmp

pid process

1928 is-RJSE7.tmp
Loads dropped DLL 3 IoCs

Processes:

B9B8BC0D8669C6E55F651DCA76E9A1A9.exeis-RJSE7.tmp

pid process

1572 B9B8BC0D8669C6E55F651DCA76E9A1A9.exe
1928 is-RJSE7.tmp
1928 is-RJSE7.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1928	is-RJSE7.tmp

pid	process
1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe
1928	is-RJSE7.tmp
1928	is-RJSE7.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

B9B8BC0D8669C6E55F651DCA76E9A1A9.exe

description	pid	process	target process
PID 1572 wrote to memory of 1928	1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe	is-RJSE7.tmp
PID 1572 wrote to memory of 1928	1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe	is-RJSE7.tmp
PID 1572 wrote to memory of 1928	1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe	is-RJSE7.tmp
PID 1572 wrote to memory of 1928	1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe	is-RJSE7.tmp
PID 1572 wrote to memory of 1928	1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe	is-RJSE7.tmp
PID 1572 wrote to memory of 1928	1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe	is-RJSE7.tmp
PID 1572 wrote to memory of 1928	1572	B9B8BC0D8669C6E55F651DCA76E9A1A9.exe	is-RJSE7.tmp

C:\Users\Admin\AppData\Local\Temp\B9B8BC0D8669C6E55F651DCA76E9A1A9.exe
"C:\Users\Admin\AppData\Local\Temp\B9B8BC0D8669C6E55F651DCA76E9A1A9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Local\Temp\is-AO47O.tmp\is-RJSE7.tmp
"C:\Users\Admin\AppData\Local\Temp\is-AO47O.tmp\is-RJSE7.tmp" /SL4 $60124 "C:\Users\Admin\AppData\Local\Temp\B9B8BC0D8669C6E55F651DCA76E9A1A9.exe" 16185951 52224
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-AO47O.tmp\is-RJSE7.tmp
Filesize
656KB

MD5
4fa180886ff7c0fd86a65f760ede6318

SHA1
2c89c271c71531362e84ddab5d3028f0756a9281

SHA256
1d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c

SHA512
a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AO47O.tmp\is-RJSE7.tmp
Filesize
656KB

MD5
4fa180886ff7c0fd86a65f760ede6318

SHA1
2c89c271c71531362e84ddab5d3028f0756a9281

SHA256
1d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c

SHA512
a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd

Download Submit
\Users\Admin\AppData\Local\Temp\is-AO47O.tmp\is-RJSE7.tmp
Filesize
656KB

MD5
4fa180886ff7c0fd86a65f760ede6318

SHA1
2c89c271c71531362e84ddab5d3028f0756a9281

SHA256
1d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c

SHA512
a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd

Download Submit
\Users\Admin\AppData\Local\Temp\is-USN4R.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-USN4R.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1572-54-0x00000000755F1000-0x00000000755F3000-memory.dmp

Filesize
8KB

Download
memory/1572-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1572-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1928-57-0x0000000000000000-mapping.dmp

Download