e831fcb1c9929f4a88ea82c364de4114a5f2012e90cda1ba35316b8eb311e39b

Analysis

max time kernel
8s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.4MB
Sample221028-2fycvaaab5
SHA256 e831fcb1c9929f4a88ea82c364de4114a5f2012e90cda1ba35316b8eb311e39b
MD5 4171b6aadeea83b05a615b6c0bd8fcce
SHA1 20106c4c416c729acf92eea51c284f83105a8844
SHA512 71fc87a8cccd68c405ed26ce446536d3e6554b0fb8fd377c4c68199b4edc7ea9919592c302e0242e8101e078ae618531df81db5438fa16d8934fc33b8de0f5d9
SSDEEP 49152:Z2eusNpW8xNxjVjkSjU1aQMikUS8x7MWNlk6Y+RXPtK0MROb2EmZLCtA5hq:MexN3xvhgdaXi175sgRXE00LDq
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
980	is-AOT28.tmp

Loads dropped DLL 1 IoCs

pid	Process
980	is-AOT28.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 980	2112	file.exe	28
PID 2112 wrote to memory of 980	2112	file.exe	28
PID 2112 wrote to memory of 980	2112	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\is-FSK0I.tmp\is-AOT28.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FSK0I.tmp\is-AOT28.tmp" /SL4 $801D6 "C:\Users\Admin\AppData\Local\Temp\file.exe" 2315697 52736
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

is-AOT28.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-FSK0I.tmp\is-AOT28.tmp
Size 27KB
SHA256 0b8824a7bd7f28a9a0b502eaf091b731856dd07c97c24baa5d67f1d965568eac
MD5 0466bb9f93b61aefd58e1afa0ed71984
SHA1 ab2890aa3ff858487dc52fc68c4a6fa5e98836e9
SHA512 333579af310c8048423bceee6bc1a79c8b22bab409f5b702647bf5fab5150b6636b03c7bef4152e849371a3cb75a1d6931333528a96dd654714a5235589e943b
SSDEEP 768:bCvbtIqQGK+vm46GUhxOmkg9ypawmt1trg3LUoCGn7f:2vhIqQGK+vexOD0BWFn7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-AOT28.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-FSK0I.tmp\is-AOT28.tmp
Size 36KB
SHA256 3716288e9d0736149601558eaeb1436568d703e6a0c0ae6ff034649d32ab12c1
MD5 e34aceaf3d3239d078549efce9a0e071
SHA1 b065419788647b68bc2fc59662cca3679f946d3d
SHA512 fd40276b8ba939a2d53b484d00b0eced6c9ed24919549426bdc3142d17eb8bb9b9713a0e09c726270e25beabedd5a0617ed51ec02ef20300c90ff5e3aaff1151
SSDEEP 768:bCvbtIqQGK+vm46GUhxOmkg9ypawmt1trg3LUoCGn7j3LT5gysEUuAf:2vhIqQGK+vexOD0BWFn75KuAf
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-K9H1P.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

memory/2112-132-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2112-134-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2112-139-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads