938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97

Analysis

max time kernel
111s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
11/05/2022, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fae07b21b2ce5aa949208dd0540b768.exe
Size 2.0MB
Sample220511-jbs88aafdn
SHA256 938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97
MD5 4fae07b21b2ce5aa949208dd0540b768
SHA1 98d1ceaf325f590999ce53677bf8bd47b2dbb0da
SHA512 08b6b1f71b1b3078aa0c4df2428d6329ef2660575b09941c4936535a93ac482167bd82048c5da7254fe9c1383f2c35b3a3312f2ec0aa9679fd1ee4c3165638df
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1100	rundll32.exe
1968	rundll32.exe
1968	rundll32.exe
1968	rundll32.exe
1968	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1940	1068	4fae07b21b2ce5aa949208dd0540b768.exe	28
PID 1068 wrote to memory of 1940	1068	4fae07b21b2ce5aa949208dd0540b768.exe	28
PID 1068 wrote to memory of 1940	1068	4fae07b21b2ce5aa949208dd0540b768.exe	28
PID 1068 wrote to memory of 1940	1068	4fae07b21b2ce5aa949208dd0540b768.exe	28
PID 1940 wrote to memory of 1100	1940	control.exe	29
PID 1940 wrote to memory of 1100	1940	control.exe	29
PID 1940 wrote to memory of 1100	1940	control.exe	29
PID 1940 wrote to memory of 1100	1940	control.exe	29
PID 1940 wrote to memory of 1100	1940	control.exe	29
PID 1940 wrote to memory of 1100	1940	control.exe	29
PID 1940 wrote to memory of 1100	1940	control.exe	29
PID 1100 wrote to memory of 1708	1100	rundll32.exe	30
PID 1100 wrote to memory of 1708	1100	rundll32.exe	30
PID 1100 wrote to memory of 1708	1100	rundll32.exe	30
PID 1100 wrote to memory of 1708	1100	rundll32.exe	30
PID 1708 wrote to memory of 1968	1708	RunDll32.exe	31
PID 1708 wrote to memory of 1968	1708	RunDll32.exe	31
PID 1708 wrote to memory of 1968	1708	RunDll32.exe	31
PID 1708 wrote to memory of 1968	1708	RunDll32.exe	31
PID 1708 wrote to memory of 1968	1708	RunDll32.exe	31
PID 1708 wrote to memory of 1968	1708	RunDll32.exe	31
PID 1708 wrote to memory of 1968	1708	RunDll32.exe	31

C:\Users\Admin\AppData\Local\Temp\4fae07b21b2ce5aa949208dd0540b768.exe
"C:\Users\Admin\AppData\Local\Temp\4fae07b21b2ce5aa949208dd0540b768.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL",
        5⤵
        Loads dropped DLL
        
        PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~pHDfR3I.CPL

Path C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL
Size 336.3MB
SHA256 9cab31336c696b864dfbb2f20188da241128498809da5795a2444f4d93fa7722
MD5 c42f6ad2046545ba0f858c5c16387634
SHA1 4fdb98e5062bbcd2ab51309cd7e77e69c17b5939
SHA512 dda735c9dfc854c8ae505e9451ee9c27e9000b6de83d873b5fcf562ac139e69edb6d54fbe96fb0336343265ce2ad26152cbe03e8bbe073ecfbdfcc2466da88ff
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYPE:MkzHRxbMAWTEnhDTQFPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 336.0MB
SHA256 b3eda7063a64b63a42c7a46b32e78a3698fc37371ef875aba2f5fcfdf6569975
MD5 501c130fa68f64d5df2bd6ca97115be8
SHA1 f75885eddb3ea36023818eb7dcd331276be5e069
SHA512 9aa76db5bda8a27cdf31a8ac2e2c39b4cd82c2197a42fe906c052d1bfead952ca14ebae67464c040607f1a40386ed45829f5029afc69f914c6492ef3b5310d03
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 334.4MB
SHA256 78e2b239ce26b31c27f455826a043cd009f4c6558044491c2b10f45ff89e4496
MD5 ec1e54c57cb9d6ed3631219a38929d36
SHA1 7192f109a5d776bcaedca989a0bd00bb45cc39e0
SHA512 4734e4f7b507ab9b0f160edd44fc7e62300b0c3a37ed3a6be16b170312197c9064fe6ee629158313e59726aeacd7166bf78a63a96a4ba163edb9d5c5909f60ad
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 336.4MB
SHA256 38d1704bc85cd226d7baac362fe6d75500351150d107b19f888ee5992048b705
MD5 cd78c657ecee9dce4a849b7c65c5e20a
SHA1 19a27dcd29e38c6a22219eb8c4f4dffa0a195161
SHA512 a73f5942124871d1a84d3465cab07b27151a5030d1e1b5b10b50a1909e24747973fa92d56c1b94c1f603460798bd5355631f9158fff5002be90f5d53ea1f83dc
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 317.1MB
SHA256 8c48551f04d649fac92bc4ea1a977c194555d1e16f0df03fff9e1660b823edf5
MD5 527613c5a534544492ee3788337ff6ee
SHA1 12d507afed189e71cbe1984c8557af9094ae4119
SHA512 2e3cb978aa58ed2f2e0486a2049af395cb2079d4f9a332d021438a87c35142b1e9c6344b58d410e3d0138477efb96eab9240e69eb4f22d76034a985f36b377a4
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 162.2MB
SHA256 79d1b2a823d35364fe7597098e4daad0616b8b7b78ce9f8d6856aeb77d838815
MD5 9c611eeaf410d1d7297af790221122e0
SHA1 e6805905c0c322e9e4a2650f7f92753bfdf62c22
SHA512 4868487238da9736d738358732ba9ba69f550d57de87ef5523570a77003f5392bf0e5de83a6c8b47b8943facd89bc23f0ce9bacba9cc055f9bfebb4da8aee016
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 159.1MB
SHA256 beb591e65aac6c7e95a5874b310cb1dd97803df2aaa5511cbb0af9103dcbb442
MD5 85ff8846501f468645308d3267d339da
SHA1 69f3313e95701b1bea984cd858f88ead40829de1
SHA512 10ef8fb243ff495597942d50f34b56e7c36807d37ffa7d46f29c12e234c7b095cf18b6c6082952c0d5c3bbbd5061ecedce487dbea891ac9e311d28d2ff36351b
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 114.2MB
SHA256 47c1c3f5a2ccec6e6ea9d5ba1e159c3b8a4bfacc0d8a8e914d326d40198d4e32
MD5 24c40993ccaf910e29fbaffe491a1872
SHA1 f6acb3a694bdacef2716dc6e7bd1e79ec9861c98
SHA512 1216c16b1646db41822d0575148a163bc29a068df65f88e7d3af57cfbf3810473b4e513d76e4f50633a707205010d7f1b968856fc2587803d272f9b3b080dd0c
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path \Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 115.2MB
SHA256 fd44e886f786bbba364a0e215acf54d46d9a4f78520d3844ba57b4d40f3b36cf
MD5 9d819c28fc693640fff83bb2ffe526cb
SHA1 ee0806f508a2601c802d7191cc79449ba86e7403
SHA512 b5f80f5cf13e29d99f519beba0bf7c8227555fe2b61eac4ee2f54da30996b9689c2de77baffaf950ef15a805028960913e611819f13fe9035fec4b5019c976b9
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Download

memory/1100-67-0x000000002D8B0000-0x000000002D964000-memory.dmp

Download

memory/1100-68-0x0000000001E00000-0x0000000001EA0000-memory.dmp

Download

memory/1100-69-0x0000000001E00000-0x0000000001EA0000-memory.dmp

Download

memory/1100-66-0x000000002D7F0000-0x000000002D8AA000-memory.dmp

Download

memory/1100-65-0x000000002D670000-0x000000002D72E000-memory.dmp

Download

memory/1968-79-0x000000002D8A0000-0x000000002D954000-memory.dmp

Download

memory/1968-81-0x0000000000300000-0x00000000003A0000-memory.dmp

Download

memory/1968-83-0x000000002D7E0000-0x000000002D89A000-memory.dmp

Download

memory/1968-84-0x00000000025F0000-0x00000000035F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads