Analysis

  • max time kernel
    38s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2022, 22:56

General

  • Target

    317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe

  • Size

    814KB

  • MD5

    2fafd81ce2a7cf25fa73863d098de711

  • SHA1

    a84f8b96d702d24786f5bd500f5620982a080c40

  • SHA256

    317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17

  • SHA512

    3563c68b365befefc8e1bdffa51d31025d6fdeef7f210da7d54c10c4f54d365b23ce5868808cfc68f084a4a27ae5689750a8349d2fefe112b1abcb65ca8cbbc7

  • SSDEEP

    12288:l0nyfXuIBDtfuCSHjWb8LM1cWMU66Pmgfc1Snv2QJz88WZBtVAXWc0:Sny/f9uCMWdqU66jESnv2Qx8HZBHM0

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe
    "C:\Users\Admin\AppData\Local\Temp\317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:2036

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe

          Filesize

          908KB

          MD5

          c3ac43b2018114a617e946aa8fdf3cac

          SHA1

          2d90f38bc995c9cd5efec52109f8bd2468001ca7

          SHA256

          ef6c5fe9f08be67f24c7dfa5c7bc3d69ab4e387e6065602d45ba358289f05117

          SHA512

          8c471a2575751c5995b10859219b979d75c8e8e4496604c0718268d8367790c5bb8e6dd47c735dcecd02a62dbb0d8fbbb70ea1d085ad7b798491a3d831cd9488

        • \Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe

          Filesize

          908KB

          MD5

          c3ac43b2018114a617e946aa8fdf3cac

          SHA1

          2d90f38bc995c9cd5efec52109f8bd2468001ca7

          SHA256

          ef6c5fe9f08be67f24c7dfa5c7bc3d69ab4e387e6065602d45ba358289f05117

          SHA512

          8c471a2575751c5995b10859219b979d75c8e8e4496604c0718268d8367790c5bb8e6dd47c735dcecd02a62dbb0d8fbbb70ea1d085ad7b798491a3d831cd9488

        • \Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe

          Filesize

          908KB

          MD5

          c3ac43b2018114a617e946aa8fdf3cac

          SHA1

          2d90f38bc995c9cd5efec52109f8bd2468001ca7

          SHA256

          ef6c5fe9f08be67f24c7dfa5c7bc3d69ab4e387e6065602d45ba358289f05117

          SHA512

          8c471a2575751c5995b10859219b979d75c8e8e4496604c0718268d8367790c5bb8e6dd47c735dcecd02a62dbb0d8fbbb70ea1d085ad7b798491a3d831cd9488

        • \Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe

          Filesize

          908KB

          MD5

          c3ac43b2018114a617e946aa8fdf3cac

          SHA1

          2d90f38bc995c9cd5efec52109f8bd2468001ca7

          SHA256

          ef6c5fe9f08be67f24c7dfa5c7bc3d69ab4e387e6065602d45ba358289f05117

          SHA512

          8c471a2575751c5995b10859219b979d75c8e8e4496604c0718268d8367790c5bb8e6dd47c735dcecd02a62dbb0d8fbbb70ea1d085ad7b798491a3d831cd9488

        • memory/1988-54-0x0000000075911000-0x0000000075913000-memory.dmp

          Filesize

          8KB

        • memory/2036-58-0x000007FEFBF01000-0x000007FEFBF03000-memory.dmp

          Filesize

          8KB