1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe
Size

56KB
MD5

7a72328e4f3ae6a6bdc4ed9498a79480
SHA1

6293783688f2c6728db8dd4bddbcfb15766c7012
SHA256

1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5
SHA512

b96fbc554d86859771ccf3adb41becfd175706b2487902f8081c9b95704513d1c4f235cf91da7528061facfd4e94aee6523381acbe7544aab9d33f74f86aa9de
SSDEEP

1536:nyZMSZFvknTePMZd4k4kJJTGCxBPQVy8uo2ODZQg45:yZMJnTeM4cJJT5fPZ8COFQF

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe
1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe
Token: SeBackupPrivilege	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1120	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe	27
PID 1448 wrote to memory of 1120	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe	27
PID 1448 wrote to memory of 1120	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe	27
PID 1448 wrote to memory of 1120	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe	27
PID 1448 wrote to memory of 1120	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe	27
PID 1448 wrote to memory of 1120	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe	27
PID 1448 wrote to memory of 1120	1448	1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe	27

C:\Users\Admin\AppData\Local\Temp\1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe
"C:\Users\Admin\AppData\Local\Temp\1d65f2034b74d95e1759bb3340cb25142a1a8bab76b5276f4984556e0efae6a5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\ife.txt "C:\PROGRA~1\INTERN~1\ieframe.dll" /a
  2⤵
  - Drops file in Program Files directory
  PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ife.txt

Filesize
19.3MB

MD5
9f704d06907633ef90a6386da311fd1c

SHA1
5122a7364d72cbbd40d80a191bd4d8000e638c2b

SHA256
f4bd4f3dfe1445416e17ee78d163e44f005bd17d105bfaa2992a0d7c6ef12726

SHA512
0b61b49c9618c30b38015b7ee5fa839296c2bdf548d67f2e1c9c9621427cfbac1b87e1f00512efa9e2551e7262eb73e8b567d64a170e0a13fe35fd77d360b60a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1E8A.tmp\nsExec.dll

Filesize
6KB

MD5
e54eb27fb5048964e8d1ec7a1f72334b

SHA1
2b76d7aedafd724de96532b00fbc6c7c370e4609

SHA256
ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

SHA512
c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1E8A.tmp\time.dll

Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download