Analysis

  • max time kernel
    159s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 03:37

General

  • Target

    Inwigilator 360 demo/InstalujDemo.exe

  • Size

    3.0MB

  • MD5

    e42a11c5397cb89381f62427aebc7dd3

  • SHA1

    62bb6cea55d10ff3ef7c0d85ef01d3951731a569

  • SHA256

    c212faf6938b25555d39ea79b0ef13a7407b60d1879316a005d2c7a2bc5a104d

  • SHA512

    569a1dcb4dbc4d0e8a7e049fba8c622647fdee65113955e856a4585fa61415d0d8f2b044129f89695df371c1e7e6f5d3326b292312b95a470e7d4917acfbb397

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Inwigilator 360 demo\InstalujDemo.exe
    "C:\Users\Admin\AppData\Local\Temp\Inwigilator 360 demo\InstalujDemo.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\is-UCQDL.tmp\is-E8LH7.tmp
      C:\Users\Admin\AppData\Local\Temp\is-UCQDL.tmp\is-E8LH7.tmp /SL4 $4002E "C:\Users\Admin\AppData\Local\Temp\Inwigilator 360 demo\InstalujDemo.exe" 3091997 68096
      2⤵
      • Executes dropped EXE
      PID:1888

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-UCQDL.tmp\is-E8LH7.tmp
    Filesize

    551KB

    MD5

    2a3152c6ff21197f67ca1d9360ced0dc

    SHA1

    5272f3d3d324b23de1b53c84ef598de494ad7821

    SHA256

    96b8be7cb1fec885cba93386b5b6814452efc8d0ef391385adafb34a611ab5ac

    SHA512

    19ba6d65a3c256c80cab767210c837197046250d769fa915b5023bf99bf53d21c56892da15ebc82891ba5fd9a45e0336fefc94ebabe5698e7911c6fabbb09cd0

  • C:\Users\Admin\AppData\Local\Temp\is-UCQDL.tmp\is-E8LH7.tmp
    Filesize

    551KB

    MD5

    2a3152c6ff21197f67ca1d9360ced0dc

    SHA1

    5272f3d3d324b23de1b53c84ef598de494ad7821

    SHA256

    96b8be7cb1fec885cba93386b5b6814452efc8d0ef391385adafb34a611ab5ac

    SHA512

    19ba6d65a3c256c80cab767210c837197046250d769fa915b5023bf99bf53d21c56892da15ebc82891ba5fd9a45e0336fefc94ebabe5698e7911c6fabbb09cd0

  • memory/1336-130-0x0000000000400000-0x0000000000418000-memory.dmp
    Filesize

    96KB

  • memory/1336-131-0x0000000000400000-0x0000000000418000-memory.dmp
    Filesize

    96KB

  • memory/1888-132-0x0000000000000000-mapping.dmp