c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-09-2022 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe
Size

512KB
MD5

226adb34a3b1c76c418a4518f0aef462
SHA1

3ee723ac8fd27153789b2750b99b853bb7d60526
SHA256

c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e
SHA512

f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6
SSDEEP

12288:ARTO7KNDsJValqO+Ibz1Tx1YFDT4DQFu/U3buRKlemZ9DnGAer7k5PQIg7:AU8DQaEuNz9ef8

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1172	nssvc32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe	c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe

Loads dropped DLL 2 IoCs

pid	Process
1736	c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe
1736	c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe
1172	nssvc32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1172	1736	c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe	27
PID 1736 wrote to memory of 1172	1736	c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe	27
PID 1736 wrote to memory of 1172	1736	c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe	27
PID 1736 wrote to memory of 1172	1736	c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe	27

C:\Users\Admin\AppData\Local\Temp\c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe
"C:\Users\Admin\AppData\Local\Temp\c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe

Filesize
512KB

MD5
226adb34a3b1c76c418a4518f0aef462

SHA1
3ee723ac8fd27153789b2750b99b853bb7d60526

SHA256
c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

SHA512
f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe

Filesize
512KB

MD5
226adb34a3b1c76c418a4518f0aef462

SHA1
3ee723ac8fd27153789b2750b99b853bb7d60526

SHA256
c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

SHA512
f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe

Filesize
512KB

MD5
226adb34a3b1c76c418a4518f0aef462

SHA1
3ee723ac8fd27153789b2750b99b853bb7d60526

SHA256
c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

SHA512
f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe

Filesize
512KB

MD5
226adb34a3b1c76c418a4518f0aef462

SHA1
3ee723ac8fd27153789b2750b99b853bb7d60526

SHA256
c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

SHA512
f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6

Download Submit
memory/1172-57-0x0000000000000000-mapping.dmp

Download
memory/1736-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download