a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3

Analysis

max time kernel
189s
max time network
216s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe
Size

94KB
MD5

ab60df90ce9dfc65163998e8b662a3cd
SHA1

0a96a1eb131c57fd0c9f561cef7d67986eb86752
SHA256

a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3
SHA512

79b884729b004f3da3bde017722f0d28bf930720c312fed1c3bbc6faa2b27c03cc6f72150161f4009d5390d56d3fbe1059322efe04612142ad52e3daa9acdc85
SSDEEP

1536:xaqXOxQpE1Jc61YHZGkLVKETkMquNPUQlcXYqxLpE/rYeHLpyGFcZLfXw9:b4b1nKGKVKokMquNPUKcXYqxLpE/cer1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2044	2130567168.exe

Loads dropped DLL 2 IoCs

pid	Process
1972	a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe
1972	a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2044	1972	a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe	28
PID 1972 wrote to memory of 2044	1972	a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe	28
PID 1972 wrote to memory of 2044	1972	a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe	28
PID 1972 wrote to memory of 2044	1972	a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe	28

C:\Users\Admin\AppData\Local\Temp\a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe
"C:\Users\Admin\AppData\Local\Temp\a63d10efff4f2f9c8e3b544d8fae448e99ddaed8a73b94b41ac0add6eb108be3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\2130567168.exe
  "C:\Users\Admin\AppData\Local\Temp\2130567168.exe"
  2⤵
  - Executes dropped EXE
  PID:2044

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2130567168.exe

Filesize
7KB

MD5
8d57a9068dc824cbf1fb0ee7b2d599d8

SHA1
179e21f711a00622176a19bb8d291780e103597e

SHA256
0cb49ffb02badfe20a808a8b6c7f252606e1decf2f6b5026b57aee4e1665731f

SHA512
cd84e2fd7539fcb280c3bef710cd3aca80cfb05a71dcbb459d25051929511ef2f9be9f27046e63587e55d7b0cff9a1bb2038255949e05181e9065da8d2ad61a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2130567168.exe

Filesize
7KB

MD5
8d57a9068dc824cbf1fb0ee7b2d599d8

SHA1
179e21f711a00622176a19bb8d291780e103597e

SHA256
0cb49ffb02badfe20a808a8b6c7f252606e1decf2f6b5026b57aee4e1665731f

SHA512
cd84e2fd7539fcb280c3bef710cd3aca80cfb05a71dcbb459d25051929511ef2f9be9f27046e63587e55d7b0cff9a1bb2038255949e05181e9065da8d2ad61a4

Download Submit
\Users\Admin\AppData\Local\Temp\2130567168.exe

Filesize
7KB

MD5
8d57a9068dc824cbf1fb0ee7b2d599d8

SHA1
179e21f711a00622176a19bb8d291780e103597e

SHA256
0cb49ffb02badfe20a808a8b6c7f252606e1decf2f6b5026b57aee4e1665731f

SHA512
cd84e2fd7539fcb280c3bef710cd3aca80cfb05a71dcbb459d25051929511ef2f9be9f27046e63587e55d7b0cff9a1bb2038255949e05181e9065da8d2ad61a4

Download Submit
\Users\Admin\AppData\Local\Temp\2130567168.exe

Filesize
7KB

MD5
8d57a9068dc824cbf1fb0ee7b2d599d8

SHA1
179e21f711a00622176a19bb8d291780e103597e

SHA256
0cb49ffb02badfe20a808a8b6c7f252606e1decf2f6b5026b57aee4e1665731f

SHA512
cd84e2fd7539fcb280c3bef710cd3aca80cfb05a71dcbb459d25051929511ef2f9be9f27046e63587e55d7b0cff9a1bb2038255949e05181e9065da8d2ad61a4

Download Submit
memory/688-60-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/1972-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download