1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01

Analysis

max time kernel
80s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 23:37

Target

1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe
Size

38KB
MD5

16b48000f29c673acff6edf9dc00da1a
SHA1

ab1ce71c858de5103b9609072f8b8cfb5d29905f
SHA256

1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01
SHA512

a3c193c23bd9e590e2766fe3658a0385c5921084e10f5d92d9167847a6f657502bde8b2de8289485825dc4a5ae333b9c5f829ca1131bfd9b889a30acf5376d70
SSDEEP

384:uef57+f2a/zf+C0bxnunr5i7n2FbtauavQz9ygh:tI3/bUVnunrZFKYzc

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

DivX Player.exe

pid process

576 DivX Player.exe

pid	process
576	DivX Player.exe

Loads dropped DLL 2 IoCs

Processes:

1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe

pid	process
836	1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe
836	1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DivX Player.exe

pid process

576 DivX Player.exe

pid	process
576	DivX Player.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe

description	pid	process	target process
PID 836 wrote to memory of 576	836	1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe	DivX Player.exe
PID 836 wrote to memory of 576	836	1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe	DivX Player.exe
PID 836 wrote to memory of 576	836	1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe	DivX Player.exe
PID 836 wrote to memory of 576	836	1988318391a2a470290f7bfde5c6ef2a1f8d67461dac019b9a6af65fdfe77c01.exe	DivX Player.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\DivX Player.exe

Filesize
20KB

MD5
7ca70c169648636279b24c014bb95c11

SHA1
1094800eaed3a37c34060eb027009235e6921e6b

SHA256
6cf129b3ebf51b42dd49bf051f1675064bd3ae9da705e34f129369333278be4b

SHA512
7288998d1cdd331f79b38d4a518608615b64c394db3029bdafe3ddef8fc38f9fa5a44ff5c98592a036b63a471e91228d362a0ec9e005ca1765c12b572daa7c11

Download Submit
\Users\Admin\AppData\Local\Temp\DivX Player.exe

Filesize
20KB

MD5
7ca70c169648636279b24c014bb95c11

SHA1
1094800eaed3a37c34060eb027009235e6921e6b

SHA256
6cf129b3ebf51b42dd49bf051f1675064bd3ae9da705e34f129369333278be4b

SHA512
7288998d1cdd331f79b38d4a518608615b64c394db3029bdafe3ddef8fc38f9fa5a44ff5c98592a036b63a471e91228d362a0ec9e005ca1765c12b572daa7c11

Download Submit
\Users\Admin\AppData\Local\Temp\DivX Player.exe

Filesize
20KB

MD5
7ca70c169648636279b24c014bb95c11

SHA1
1094800eaed3a37c34060eb027009235e6921e6b

SHA256
6cf129b3ebf51b42dd49bf051f1675064bd3ae9da705e34f129369333278be4b

SHA512
7288998d1cdd331f79b38d4a518608615b64c394db3029bdafe3ddef8fc38f9fa5a44ff5c98592a036b63a471e91228d362a0ec9e005ca1765c12b572daa7c11

Download Submit
memory/576-57-0x0000000000000000-mapping.dmp

Download
memory/836-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download