Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-07-2022 13:55

General

  • Target

    4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe

  • Size

    239KB

  • MD5

    70e4f687246a47cec452122577f458be

  • SHA1

    4b33871966fc98360918bbd5231dc7f2eb9bd3b7

  • SHA256

    4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876

  • SHA512

    16e75542f96a8f985c1a7d3a6d012d8e0314a8b68f095217acae60c475c6de34408f8029650349536a95fdc094b9e2acbbaa256b65cc939c4025b6e7ab858594

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe
    "C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe
      "C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe"
      2⤵
        PID:1260

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsd13E0.tmp\System.dll

      Filesize

      11KB

      MD5

      ca332bb753b0775d5e806e236ddcec55

      SHA1

      f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

      SHA256

      df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

      SHA512

      2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

    • memory/1092-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

      Filesize

      8KB

    • memory/1092-56-0x00000000007E0000-0x00000000007FE000-memory.dmp

      Filesize

      120KB

    • memory/1092-59-0x00000000007E0000-0x00000000007FE000-memory.dmp

      Filesize

      120KB

    • memory/1260-57-0x00000000001D56BA-mapping.dmp

    • memory/1260-60-0x00000000001D0000-0x00000000001F7000-memory.dmp

      Filesize

      156KB

    • memory/1260-61-0x0000000000290000-0x00000000002B7000-memory.dmp

      Filesize

      156KB