43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe
Size

55KB
MD5

679c60426d5e8302598c87d4c5e7057c
SHA1

d15283bb9cdcb43476bd3cd4d4de1f5ef9356ec1
SHA256

43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a
SHA512

6f9eaf9566ba71531197ce618c6ea02ab2346acb646e6477308a8a105553f6d4317b52959af2337868dc978a9b83d2a36157f13effe4e5d2d0b558a26cb8273e
SSDEEP

1536:u3cpyORJLuB4P4AJJvCCIt51SUdbMFCTWOphf:u3c1fP4AJJv1W9L3f

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe
1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe
Token: SeBackupPrivilege	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 852	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe	27
PID 1536 wrote to memory of 852	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe	27
PID 1536 wrote to memory of 852	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe	27
PID 1536 wrote to memory of 852	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe	27
PID 1536 wrote to memory of 852	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe	27
PID 1536 wrote to memory of 852	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe	27
PID 1536 wrote to memory of 852	1536	43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe	27

C:\Users\Admin\AppData\Local\Temp\43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe
"C:\Users\Admin\AppData\Local\Temp\43f9fd002007c82aea53f1c712f0a40a242297983de5e1044aa118dadbe58b4a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\ife.txt "C:\PROGRA~1\INTERN~1\ieframe.dll" /a
  2⤵
  - Drops file in Program Files directory
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ife.txt

Filesize
19.6MB

MD5
11df3de7e80bf981f7000dc9e6328692

SHA1
0bfd6bd455142ecf97dfef88390347cc5e62de41

SHA256
f7d9bb318b356aafb1e4c56cdfd64a42bff01708c784cc85d12b9b9677ba3f4b

SHA512
41e8a2476d2e6a15bf414c3e5d30d7d01e56c3f5af1eae43af0ec1982c27e253b58087005d9bedbe8357d92d9a34b5bad7c456150c7bdf63905cf4dbe6c92164

Download Submit
\Users\Admin\AppData\Local\Temp\nst698F.tmp\nsExec.dll

Filesize
6KB

MD5
e54eb27fb5048964e8d1ec7a1f72334b

SHA1
2b76d7aedafd724de96532b00fbc6c7c370e4609

SHA256
ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

SHA512
c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst698F.tmp\time.dll

Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit
memory/1536-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download