59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126

Analysis

max time kernel
64s
max time network
184s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
12-10-2022 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126.exe
Size

1.4MB
MD5

a44a6a43588485bc53f4c3eaaf7dd318
SHA1

2954b3a8afdabfde9967f7f7523ca860e23af04f
SHA256

59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126
SHA512

232e30520827fb547452aa726177e9e4a15608949628baf1cbfe7fae9c4ba3b9c5aa28ccbd6fd1ccb1d61a77dfe539681a5c14503f232e377a5f92bb10d58feb
SSDEEP

24576:pLlgAi5b8Pf3GQKmuy37HK++9He2UPuqa57lH4GdRyg:pyof92arv+ppN57J4Bg

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4200	msiexec.exe
4200	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4200	3036	59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126.exe	66
PID 3036 wrote to memory of 4200	3036	59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126.exe	66
PID 3036 wrote to memory of 4200	3036	59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126.exe	66

C:\Users\Admin\AppData\Local\Temp\59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126.exe
"C:\Users\Admin\AppData\Local\Temp\59b09f269cae94ebeb3d7f0d467427267267615c1a555dae741506bc89aa5126.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" -Y .\rU84TP.F
  2⤵
  - Loads dropped DLL
  PID:4200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rU84TP.F

Filesize
1.5MB

MD5
de7d60fd505843299c1e5f0a955c62b4

SHA1
fc6183f35c7b0e2fc995ca666bf9e68163cb676b

SHA256
17be90292ff5d5b673e56e7fc355baf36a3db556a046d95bf1cc54e53e1c9b16

SHA512
2ca879ff6b1f393778ba2bc6d5af0accf53731b6c9a14e2c63ca7fcae11b4ffeea461ddc916b3d0e108dd9ab349f1b2bdd0a12d76bdfd021be2cd512609ff826

Download Submit
\Users\Admin\AppData\Local\Temp\ru84tP.F

Filesize
1.5MB

MD5
de7d60fd505843299c1e5f0a955c62b4

SHA1
fc6183f35c7b0e2fc995ca666bf9e68163cb676b

SHA256
17be90292ff5d5b673e56e7fc355baf36a3db556a046d95bf1cc54e53e1c9b16

SHA512
2ca879ff6b1f393778ba2bc6d5af0accf53731b6c9a14e2c63ca7fcae11b4ffeea461ddc916b3d0e108dd9ab349f1b2bdd0a12d76bdfd021be2cd512609ff826

Download Submit
\Users\Admin\AppData\Local\Temp\ru84tP.F

Filesize
1.5MB

MD5
de7d60fd505843299c1e5f0a955c62b4

SHA1
fc6183f35c7b0e2fc995ca666bf9e68163cb676b

SHA256
17be90292ff5d5b673e56e7fc355baf36a3db556a046d95bf1cc54e53e1c9b16

SHA512
2ca879ff6b1f393778ba2bc6d5af0accf53731b6c9a14e2c63ca7fcae11b4ffeea461ddc916b3d0e108dd9ab349f1b2bdd0a12d76bdfd021be2cd512609ff826

Download Submit
memory/3036-116-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-117-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-118-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-119-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-121-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-122-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-124-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-125-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-126-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-127-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-128-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-129-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-130-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-131-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-132-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-134-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-133-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-135-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-136-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-137-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-138-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-139-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-140-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-141-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-142-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-143-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-144-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-145-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-146-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-147-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-149-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-148-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-150-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-151-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-152-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-153-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-154-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-155-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-156-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-157-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-158-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-159-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-160-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-161-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-162-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-163-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-164-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-165-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-166-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-167-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-168-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-169-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-170-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-171-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-172-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-173-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-174-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-175-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-176-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-177-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-178-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-179-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-180-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3036-181-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/4200-234-0x00000000048D0000-0x00000000049CC000-memory.dmp

Filesize
1008KB

Download
memory/4200-233-0x0000000004690000-0x00000000047C1000-memory.dmp

Filesize
1.2MB

Download
memory/4200-240-0x00000000048D0000-0x00000000049CC000-memory.dmp

Filesize
1008KB

Download