Overview

overview

8

Static

static

4

MSI_M92_Se....6.exe

windows7-x64

8

MSI_M92_Se....6.exe

windows10-2004-x64

8

MSI_M92_Se...te.pdf

windows7-x64

1

MSI_M92_Se...te.pdf

windows10-2004-x64

1

MSI_M92_Se....6.exe

windows7-x64

8

MSI_M92_Se....6.exe

windows10-2004-x64

8

MSI_M92_Se...te.pdf

windows7-x64

1

MSI_M92_Se...te.pdf

windows10-2004-x64

1

Note(装...).pdf

windows7-x64

1

Note(装...).pdf

windows10-2004-x64

1

Analysis

  • max time kernel
    90s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2022 15:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MSI_M92_Setup_FHD_V1.0.6.exe/MSI_M92_Setup_FHD_V1.0.6.exe

  • Size

    1.8MB

  • MD5

    440db277d34ece1ebdbd55d1b76b236d

  • SHA1

    2e137d17df4a60db3090626826d38135c6f2c433

  • SHA256

    21be81abc190fb57a3ff184656ea45717180b75448e162f092b9e99c8d0e730a

  • SHA512

    bfb49bb86a6c3c7c5fdac3f6595f3a3ef476bfe57fdae09dc765db6662d6c47783d3d74cc90f42027a5b5f64b77fb32b23831b84b50e110e6654b1c9486ddd57

  • SSDEEP

    49152:OEdFyDv0Hf7JgSSf8MI8hUwdgZSQeQO04:hKlSo8D7ZE04

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MSI_M92_Setup_FHD_V1.0.6.exe\MSI_M92_Setup_FHD_V1.0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\MSI_M92_Setup_FHD_V1.0.6.exe\MSI_M92_Setup_FHD_V1.0.6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\is-C6C9P.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-C6C9P.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp" /SL5="$90060,1520156,281088,C:\Users\Admin\AppData\Local\Temp\MSI_M92_Setup_FHD_V1.0.6.exe\MSI_M92_Setup_FHD_V1.0.6.exe"
      2⤵
      • Executes dropped EXE
      PID:4652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-C6C9P.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp
    Filesize

    1.2MB

    MD5

    07e7c0165d86d066abe308c3627dbd3e

    SHA1

    e73c3ba5412e2c7ab2e33862e38d519b10360b9f

    SHA256

    13cecb8e7045842c32099fbeeb582afa1a26f136c34815d6dff40d75743b0f72

    SHA512

    3a96af6f2a5d5a8ddad5cd6a26d2cba38e3b5979b3bfcc9f04bdcc81bb5bbbad2a9d2543896cccbafab95bbe88f1ccc6539047f879d0ac0112fc54a9dad7b2c2

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-C6C9P.tmp\MSI_M92_Setup_FHD_V1.0.6.tmp
    Filesize

    1.2MB

    MD5

    07e7c0165d86d066abe308c3627dbd3e

    SHA1

    e73c3ba5412e2c7ab2e33862e38d519b10360b9f

    SHA256

    13cecb8e7045842c32099fbeeb582afa1a26f136c34815d6dff40d75743b0f72

    SHA512

    3a96af6f2a5d5a8ddad5cd6a26d2cba38e3b5979b3bfcc9f04bdcc81bb5bbbad2a9d2543896cccbafab95bbe88f1ccc6539047f879d0ac0112fc54a9dad7b2c2

    Download Submit
  • memory/4652-134-0x0000000000000000-mapping.dmp
    Download
  • memory/4788-132-0x0000000000400000-0x0000000000451000-memory.dmp
    Filesize

    324KB

    Download
  • memory/4788-137-0x0000000000400000-0x0000000000451000-memory.dmp
    Filesize

    324KB

    Download