7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d

General

Target

7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
Size

264KB
MD5

8a76938eac3960939b0d96caad0ca670
SHA1

51d1aa88fde35179946498085c25f46edd9962c3
SHA256

7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d
SHA512

94912e8bfaca344c52c953539e289d0758c5727c56b90270ec6e88b95124613b57f5880e010861998bc9574eb4b5299d2e5425a28ba4b6a99ab6bd491fad5d57
SSDEEP

3072:b1dlKwgj23+Oz05YoNozDv4Vh97i4Liu5Z611359z9pN7qJtt7KrbX4Zb8P8o1w5:b1dlZro5yDAV1iuLQ3tN7q1c8+PVB0Z

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2004	s1a4a.exe
1980	s1a4a.exe

Loads dropped DLL 2 IoCs

pid	Process
780	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
780	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 1980	2004	s1a4a.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Extracted\æLoQ‰²ªFÈµÓ‚=\|ä¤\LÝoÅ †Š'“,8N9’ \Eò,\"¤3Ü†Ê„Ê„BDÛ, uŽõ4ÔÄwýïK©Â£'›³²HN j{œUr9È›T¦ZjQÅæeh™’K,ãÚ*ê3¨£G"C®#Ø÷k¼^¬[h‚ëÎ‚$Jš™í]Ðº¹¹‘)Ttõµb]d••Ç"ó†îŽZøž=Àu2e}\k»Rájƒ\|:Ê·,…«ëXÿ	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1980	s1a4a.exe
1980	s1a4a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	DllHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	s1a4a.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 2004	780	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe	27
PID 780 wrote to memory of 2004	780	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe	27
PID 780 wrote to memory of 2004	780	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe	27
PID 780 wrote to memory of 2004	780	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe	27
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 2004 wrote to memory of 1980	2004	s1a4a.exe	28
PID 1980 wrote to memory of 1420	1980	s1a4a.exe	15
PID 1980 wrote to memory of 1420	1980	s1a4a.exe	15
PID 1980 wrote to memory of 1420	1980	s1a4a.exe	15
PID 1980 wrote to memory of 1420	1980	s1a4a.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1420
- C:\Users\Admin\AppData\Local\Temp\7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
  "C:\Users\Admin\AppData\Local\Temp\7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe"
  2⤵
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Extracted\s1a4a.exe
    "C:\Extracted\s1a4a.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Extracted\s1a4a.exe
      C:\Extracted\s1a4a.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1980

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Extracted\,mkl.jpg

Filesize
65KB

MD5
44623e57bd74ebe038ce843f913683bf

SHA1
7e106b64be84edec547e8327d641a15c704d3d31

SHA256
c514fb54195d243748b2f719b31b452e4f16384489be488afed344f805240596

SHA512
cfe1c13c1264899a4674c6000631ea5d501c469f3c38a2c52101044677f228d48fb6448edad9a27c97b6e0a0cfcede3b5be847f56ba4028c64930a037d683acd

Download Submit
C:\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
C:\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
C:\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
memory/780-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1420-70-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1980-66-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1980-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-73-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing