88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe
Size

1.8MB
MD5

e4545acbeb2b78e0e6b17a2310dc560d
SHA1

c9fd7e6dbfe714c7ff8ed2e942c15f9897430438
SHA256

88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f
SHA512

ad6ed403519c260bb3d4f57619a3ccc4daaef5edc7fa0fc5df1894bd96fc331a15e7750477fbab74a489b3812be2c6e8886a93100af39eb60fa00c656cae6e8c
SSDEEP

24576:Nny/f9u06OBab48vf2fII1//2+4ymcU1aoAIJIhXoOfJL6L1gX/KMWdb67ZDSH9c:8FqOMXM/2+4ygA53b1KKNSITnp

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
924	fzinst.exe

Loads dropped DLL 4 IoCs

pid	Process
1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe
1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe
1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe
1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
924	fzinst.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 924	1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe	28
PID 1912 wrote to memory of 924	1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe	28
PID 1912 wrote to memory of 924	1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe	28
PID 1912 wrote to memory of 924	1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe	28
PID 1912 wrote to memory of 924	1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe	28
PID 1912 wrote to memory of 924	1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe	28
PID 1912 wrote to memory of 924	1912	88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe	28

C:\Users\Admin\AppData\Local\Temp\88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe
"C:\Users\Admin\AppData\Local\Temp\88bdbc19a3aed39c2cc40ad3a9d221f6fe7a352e35238c8a0482fed0274cea9f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\GjpPlugin\fzinst.exe
  "C:\Users\Admin\AppData\Local\Temp\GjpPlugin\fzinst.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GjpPlugin\fzinst.exe

Filesize
7.7MB

MD5
dc25cc21484c1f436441a4273b74defe

SHA1
d4c17f4bb4f225cff27f103dfff927105e42ba05

SHA256
049ede9477ba658d5a318ff2024947fe363edd1a3b83500c79fe84c83bb85f17

SHA512
eee59409e5a1a3afeeda8d1637751f39d964976b728c55a002f7f92c0cfc51f3597a5389b02b94250b50408f56469a573c178f60fb9970613ec4c97ca3a3ff12

Download Submit
\Users\Admin\AppData\Local\Temp\GjpPlugin\fzinst.exe

Filesize
7.7MB

MD5
dc25cc21484c1f436441a4273b74defe

SHA1
d4c17f4bb4f225cff27f103dfff927105e42ba05

SHA256
049ede9477ba658d5a318ff2024947fe363edd1a3b83500c79fe84c83bb85f17

SHA512
eee59409e5a1a3afeeda8d1637751f39d964976b728c55a002f7f92c0cfc51f3597a5389b02b94250b50408f56469a573c178f60fb9970613ec4c97ca3a3ff12

Download Submit
\Users\Admin\AppData\Local\Temp\GjpPlugin\fzinst.exe

Filesize
7.7MB

MD5
dc25cc21484c1f436441a4273b74defe

SHA1
d4c17f4bb4f225cff27f103dfff927105e42ba05

SHA256
049ede9477ba658d5a318ff2024947fe363edd1a3b83500c79fe84c83bb85f17

SHA512
eee59409e5a1a3afeeda8d1637751f39d964976b728c55a002f7f92c0cfc51f3597a5389b02b94250b50408f56469a573c178f60fb9970613ec4c97ca3a3ff12

Download Submit
\Users\Admin\AppData\Local\Temp\GjpPlugin\fzinst.exe

Filesize
7.7MB

MD5
dc25cc21484c1f436441a4273b74defe

SHA1
d4c17f4bb4f225cff27f103dfff927105e42ba05

SHA256
049ede9477ba658d5a318ff2024947fe363edd1a3b83500c79fe84c83bb85f17

SHA512
eee59409e5a1a3afeeda8d1637751f39d964976b728c55a002f7f92c0cfc51f3597a5389b02b94250b50408f56469a573c178f60fb9970613ec4c97ca3a3ff12

Download Submit
\Users\Admin\AppData\Local\Temp\GjpPlugin\fzinst.exe

Filesize
7.7MB

MD5
dc25cc21484c1f436441a4273b74defe

SHA1
d4c17f4bb4f225cff27f103dfff927105e42ba05

SHA256
049ede9477ba658d5a318ff2024947fe363edd1a3b83500c79fe84c83bb85f17

SHA512
eee59409e5a1a3afeeda8d1637751f39d964976b728c55a002f7f92c0cfc51f3597a5389b02b94250b50408f56469a573c178f60fb9970613ec4c97ca3a3ff12

Download Submit
memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download