3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2

Analysis

max time kernel
147s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe
Size

19KB
MD5

66ffde8dfc8362bbe0397292b33ec090
SHA1

e6ec0127888a9170a6e5be919e16f25ffbc05bcf
SHA256

3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2
SHA512

476dd7c8b95be3a8cc59a6ca3e6fa60f80da2532413e87cb6bfa20b443b44fa3bab27213c7f7c0723de5506e2ac77ffa2d0a27e08c020f52269a01eea068263a
SSDEEP

192:0KMku1uKAusfu51v7/IvY/tC5sFCsKXzfm/+j171j+QkC4duC8ffg0WYmAb:0KMku1uKAus4vC5FD+KPkChLWIb

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1924	mazon.exe

Loads dropped DLL 2 IoCs

pid	Process
2016	3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe
2016	3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1924	2016	3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe	26
PID 2016 wrote to memory of 1924	2016	3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe	26
PID 2016 wrote to memory of 1924	2016	3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe	26
PID 2016 wrote to memory of 1924	2016	3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe	26

C:\Users\Admin\AppData\Local\Temp\3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe
"C:\Users\Admin\AppData\Local\Temp\3c0357edf487aab9d87da08b24e33d848ae3c6f49f45d3d1e9ce2e882fdb23f2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\mazon.exe
  "C:\Users\Admin\AppData\Local\Temp\mazon.exe"
  2⤵
  - Executes dropped EXE
  PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mazon.exe

Filesize
19KB

MD5
7c45ac6e73819423c85d658b95a0fa0c

SHA1
cccb59528d4ee043e5d2b9f0cf7fc383d7dac14a

SHA256
6166942ca905562ed0be5d52faf950b9b5b46320cc237a5dd01246f20f4bec1e

SHA512
71dc846d0a62bc9d30f6a0120c28e9ac1a03b4d2597d057c1c8c4ab7cdc58601f1e0d48b39e156fadb76908f11174010917711ce6bde1fbf74d7a9da2d3eeff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mazon.exe

Filesize
19KB

MD5
7c45ac6e73819423c85d658b95a0fa0c

SHA1
cccb59528d4ee043e5d2b9f0cf7fc383d7dac14a

SHA256
6166942ca905562ed0be5d52faf950b9b5b46320cc237a5dd01246f20f4bec1e

SHA512
71dc846d0a62bc9d30f6a0120c28e9ac1a03b4d2597d057c1c8c4ab7cdc58601f1e0d48b39e156fadb76908f11174010917711ce6bde1fbf74d7a9da2d3eeff7

Download Submit
\Users\Admin\AppData\Local\Temp\mazon.exe

Filesize
19KB

MD5
7c45ac6e73819423c85d658b95a0fa0c

SHA1
cccb59528d4ee043e5d2b9f0cf7fc383d7dac14a

SHA256
6166942ca905562ed0be5d52faf950b9b5b46320cc237a5dd01246f20f4bec1e

SHA512
71dc846d0a62bc9d30f6a0120c28e9ac1a03b4d2597d057c1c8c4ab7cdc58601f1e0d48b39e156fadb76908f11174010917711ce6bde1fbf74d7a9da2d3eeff7

Download Submit
\Users\Admin\AppData\Local\Temp\mazon.exe

Filesize
19KB

MD5
7c45ac6e73819423c85d658b95a0fa0c

SHA1
cccb59528d4ee043e5d2b9f0cf7fc383d7dac14a

SHA256
6166942ca905562ed0be5d52faf950b9b5b46320cc237a5dd01246f20f4bec1e

SHA512
71dc846d0a62bc9d30f6a0120c28e9ac1a03b4d2597d057c1c8c4ab7cdc58601f1e0d48b39e156fadb76908f11174010917711ce6bde1fbf74d7a9da2d3eeff7

Download Submit
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download