3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe
Size

187KB
MD5

81dd9ce7f82c735af905ae13de962d49
SHA1

3eb3b4c7766e46dbb5c60f26ffffa26b38216fd6
SHA256

3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7
SHA512

c39366d5be22cac3898c2835f488bb8d1295b3f19faf2d38b05cee0cb006b81039ccaa65e45203be26507ca3a96f08b3e0d69794087fdb77e11a526a63312bbb
SSDEEP

3072:fcTadsWbvOxyEOk/fMgOOxtIyz8AudV3iB3x+y9SNcHScK6F5oCHpXGMQoDazRz6:kT+Lk3fxqyzyil2GyUHdJWMQLm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1612	.exe

Loads dropped DLL 1 IoCs

pid	Process
1044	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1612	1044	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe	28
PID 1044 wrote to memory of 1612	1044	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe	28
PID 1044 wrote to memory of 1612	1044	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe	28
PID 1044 wrote to memory of 1612	1044	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe	28

C:\Users\Admin\AppData\Local\Temp\3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe
"C:\Users\Admin\AppData\Local\Temp\3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\ .exe
  "C:\Users\Admin\AppData\Local\Temp\ .exe"
  2⤵
  - Executes dropped EXE
  PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ .exe

Filesize
187KB

MD5
81dd9ce7f82c735af905ae13de962d49

SHA1
3eb3b4c7766e46dbb5c60f26ffffa26b38216fd6

SHA256
3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7

SHA512
c39366d5be22cac3898c2835f488bb8d1295b3f19faf2d38b05cee0cb006b81039ccaa65e45203be26507ca3a96f08b3e0d69794087fdb77e11a526a63312bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ .exe

Filesize
187KB

MD5
81dd9ce7f82c735af905ae13de962d49

SHA1
3eb3b4c7766e46dbb5c60f26ffffa26b38216fd6

SHA256
3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7

SHA512
c39366d5be22cac3898c2835f488bb8d1295b3f19faf2d38b05cee0cb006b81039ccaa65e45203be26507ca3a96f08b3e0d69794087fdb77e11a526a63312bbb

Download Submit
\Users\Admin\AppData\Local\Temp\ .exe

Filesize
187KB

MD5
81dd9ce7f82c735af905ae13de962d49

SHA1
3eb3b4c7766e46dbb5c60f26ffffa26b38216fd6

SHA256
3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7

SHA512
c39366d5be22cac3898c2835f488bb8d1295b3f19faf2d38b05cee0cb006b81039ccaa65e45203be26507ca3a96f08b3e0d69794087fdb77e11a526a63312bbb

Download Submit
memory/1044-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1044-59-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download