22c221710c9492fc848dbc20ee8833a30648c07a9a7d011511820d751a4117db

Resubmissions

13-06-2022 00:03

220613-acantscfak 10

13-05-2022 11:28

220513-nkzjtahhen 8

Analysis

max time kernel
132s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
13-05-2022 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe
Size

274.0MB
MD5

b7a056258d8a9fdf06367d54b45e84b3
SHA1

7c75a2df3b88791e83ec0dfd3a023f6e8ec7361c
SHA256

7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1
SHA512

8c5ce936341b98337c3ec8365d2a3f0cf1e3a2c0dd80f1f141828e84debbcc51455042ceb9d77b850abb55debfd0d272e3fae4e9a7c102fecc85a396fd551c57

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1792	Uistqmafsp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	1540	WerFault.exe	29

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1792	1672	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	28
PID 1672 wrote to memory of 1792	1672	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	28
PID 1672 wrote to memory of 1792	1672	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	28
PID 1672 wrote to memory of 1792	1672	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	28
PID 1672 wrote to memory of 1540	1672	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	29
PID 1672 wrote to memory of 1540	1672	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	29
PID 1672 wrote to memory of 1540	1672	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	29
PID 1540 wrote to memory of 1196	1540	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	30
PID 1540 wrote to memory of 1196	1540	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	30
PID 1540 wrote to memory of 1196	1540	7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe	30

C:\Users\Admin\AppData\Local\Temp\7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe
"C:\Users\Admin\AppData\Local\Temp\7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\Uistqmafsp.exe
  "C:\Users\Admin\AppData\Local\Temp\Uistqmafsp.exe"
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe
  "C:\Users\Admin\AppData\Local\Temp\7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.exe" /s
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1540 -s 512
    3⤵
    - Program crash
    PID:1196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Uistqmafsp.exe

Filesize
997KB

MD5
dbc534854dd385e59a3f1906ddfb9020

SHA1
2b3062d82232ce10a8713829199769ff0d12e0fc

SHA256
06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

SHA512
1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

Download Submit
memory/1672-54-0x0000000000BC0000-0x0000000000E0C000-memory.dmp

Filesize
2.3MB

Download
memory/1792-58-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download