45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
Size

63KB
MD5

e55ae810df95b0006c1836bb25abd52e
SHA1

2e6a4784666dbd5238fcbaa4629ae90d55325d9e
SHA256

45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d
SHA512

ba8d09ef5e646cea831c293a005bbd806c42bafb969547ac2d85b14e5f203e1cb1743b925f9b5f93104faf5e968292a1be9b97ffae0226ffdea6335eea3ddf22
SSDEEP

1536:cumhxebkJf+FTXJ/mISlRR39DiDCbZuwQx/:cuxkZuTXJ/mTlHtuDC8X/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5052	mf.exe
2496	ef.exe

Loads dropped DLL 19 IoCs

pid	Process
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 5052	1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe	83
PID 1620 wrote to memory of 5052	1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe	83
PID 1620 wrote to memory of 5052	1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe	83
PID 1620 wrote to memory of 2496	1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe	86
PID 1620 wrote to memory of 2496	1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe	86
PID 1620 wrote to memory of 2496	1620	45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe	86

C:\Users\Admin\AppData\Local\Temp\45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe
"C:\Users\Admin\AppData\Local\Temp\45eb23303bff5da8bef5772672328158db1e69b72c6f45b44e6a7d244e77127d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\mf.exe
  C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\mf.exe "C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll"
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\ef.exe
  C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\ef.exe "C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll" -1489
  2⤵
  - Executes dropped EXE
  PID:2496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\ef.exe

Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\ef.exe

Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll.out

Filesize
20KB

MD5
abb165c393ecb8fa770124a8fd5c2b66

SHA1
e716caa41bb85814a2978a529f3056ee35dbaffa

SHA256
2910405de026eb326818b5f76bd390c1f4657c368161d6aa0c07bc1853d69771

SHA512
d532d14220faa3d48082a3bdb0a3f03e40e8c9bff5bf0028649ae078592d7f922695e3d5f2412ea8fa0fd0c4e1d9ea165ca544c161a23a9a78af76117302de4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll.out

Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll.out0

Filesize
10KB

MD5
78d81bf0045ff349610d6dbadbd7cf92

SHA1
563b74c449ca0b364378de57f4b80047567461da

SHA256
186c76ffb1ef2c0d81a6876c2a66d4e00288fea4003fd0c6c9ee485e96a556ca

SHA512
55d72a13e1072e63782fe4076206e200c811469e9532ad39feda12cdb3958f0a9fba7bc2a5cc6e0528361b24c5e0ff83b1043c4128d5b07ff77b29663e83b10c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\inetc.dll.out1

Filesize
10KB

MD5
22061af6c0929995691b6041af918213

SHA1
ad4cdb8b19ffc0ef7186bd48173747af920f1000

SHA256
df914098777125eb3e2653f3195c7b876dcdab2a72ba2f033b11ff8857b54a5d

SHA512
46456667db674221e1f2915b52330ac464df9c4c2b0c7f0538ea7f06bfade5e99ec0cbb24c3cae39e8e9fa12135e6a1a2dd8306c1d06b964bc809039ce24d999

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\mf.exe

Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\mf.exe

Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh73DF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
memory/1620-149-0x00000000022C1000-0x00000000022C4000-memory.dmp

Filesize
12KB

Download
memory/1620-158-0x00000000005B1000-0x00000000005B4000-memory.dmp

Filesize
12KB

Download
memory/2496-143-0x0000000000000000-mapping.dmp

Download
memory/5052-135-0x0000000000000000-mapping.dmp

Download