Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    14-10-2022 15:58

General

  • Target

    MSI_M92_Setup_FHD_V1.0.6.exe/MSI_M92_Setup_FHD_V1.0.6.exe

  • Size

    1.8MB

  • MD5

    440db277d34ece1ebdbd55d1b76b236d

  • SHA1

    2e137d17df4a60db3090626826d38135c6f2c433

  • SHA256

    21be81abc190fb57a3ff184656ea45717180b75448e162f092b9e99c8d0e730a

  • SHA512

    bfb49bb86a6c3c7c5fdac3f6595f3a3ef476bfe57fdae09dc765db6662d6c47783d3d74cc90f42027a5b5f64b77fb32b23831b84b50e110e6654b1c9486ddd57

  • SSDEEP

    49152:OEdFyDv0Hf7JgSSf8MI8hUwdgZSQeQO04:hKlSo8D7ZE04

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MSI_M92_Setup_FHD_V1.0.6.exe\MSI_M92_Setup_FHD_V1.0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\MSI_M92_Setup_FHD_V1.0.6.exe\MSI_M92_Setup_FHD_V1.0.6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\is-PGAD2.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PGAD2.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp" /SL5="$70124,1520156,281088,C:\Users\Admin\AppData\Local\Temp\MSI_M92_Setup_FHD_V1.0.6.exe\MSI_M92_Setup_FHD_V1.0.6.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-PGAD2.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp
    Filesize

    1.2MB

    MD5

    07e7c0165d86d066abe308c3627dbd3e

    SHA1

    e73c3ba5412e2c7ab2e33862e38d519b10360b9f

    SHA256

    13cecb8e7045842c32099fbeeb582afa1a26f136c34815d6dff40d75743b0f72

    SHA512

    3a96af6f2a5d5a8ddad5cd6a26d2cba38e3b5979b3bfcc9f04bdcc81bb5bbbad2a9d2543896cccbafab95bbe88f1ccc6539047f879d0ac0112fc54a9dad7b2c2

  • C:\Users\Admin\AppData\Local\Temp\is-PGAD2.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp
    Filesize

    1.2MB

    MD5

    07e7c0165d86d066abe308c3627dbd3e

    SHA1

    e73c3ba5412e2c7ab2e33862e38d519b10360b9f

    SHA256

    13cecb8e7045842c32099fbeeb582afa1a26f136c34815d6dff40d75743b0f72

    SHA512

    3a96af6f2a5d5a8ddad5cd6a26d2cba38e3b5979b3bfcc9f04bdcc81bb5bbbad2a9d2543896cccbafab95bbe88f1ccc6539047f879d0ac0112fc54a9dad7b2c2

  • \Users\Admin\AppData\Local\Temp\is-PGAD2.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp
    Filesize

    1.2MB

    MD5

    07e7c0165d86d066abe308c3627dbd3e

    SHA1

    e73c3ba5412e2c7ab2e33862e38d519b10360b9f

    SHA256

    13cecb8e7045842c32099fbeeb582afa1a26f136c34815d6dff40d75743b0f72

    SHA512

    3a96af6f2a5d5a8ddad5cd6a26d2cba38e3b5979b3bfcc9f04bdcc81bb5bbbad2a9d2543896cccbafab95bbe88f1ccc6539047f879d0ac0112fc54a9dad7b2c2

  • \Users\Admin\AppData\Local\Temp\is-QQMUB.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-QQMUB.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/1544-54-0x0000000075681000-0x0000000075683000-memory.dmp
    Filesize

    8KB

  • memory/1544-55-0x0000000000400000-0x0000000000451000-memory.dmp
    Filesize

    324KB

  • memory/1544-64-0x0000000000400000-0x0000000000451000-memory.dmp
    Filesize

    324KB

  • memory/1748-58-0x0000000000000000-mapping.dmp