Analysis
-
max time kernel
63s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-11-2022 06:27
Static task
static1
Behavioral task
behavioral1
Sample
01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe
Resource
win10-20220812-en
General
-
Target
01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe
-
Size
1.9MB
-
MD5
be90b179744572783f723a72ea4bd1b3
-
SHA1
8ea9a02b65e0d24b230c9295ad20ea88608b15cd
-
SHA256
01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65
-
SHA512
cfc89e2c801fee675e2ea3b7b882b94c8f52e4098ce330511ae52237c4a735b149ebc612734c65d74208421752d0138901e63156281fd4373e7da004741c2cb1
-
SSDEEP
49152:WgY4dpFlHKwDpH1C0dlqDIZj06xRRtOmQ7ip1SpD:WAFlHKwDpH1C0nq6Jf+mBkD
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3596 rundll32.exe 4872 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings 01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.execontrol.exerundll32.exeRunDll32.exedescription pid process target process PID 2196 wrote to memory of 5108 2196 01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe control.exe PID 2196 wrote to memory of 5108 2196 01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe control.exe PID 2196 wrote to memory of 5108 2196 01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe control.exe PID 5108 wrote to memory of 3596 5108 control.exe rundll32.exe PID 5108 wrote to memory of 3596 5108 control.exe rundll32.exe PID 5108 wrote to memory of 3596 5108 control.exe rundll32.exe PID 3596 wrote to memory of 4252 3596 rundll32.exe RunDll32.exe PID 3596 wrote to memory of 4252 3596 rundll32.exe RunDll32.exe PID 4252 wrote to memory of 4872 4252 RunDll32.exe rundll32.exe PID 4252 wrote to memory of 4872 4252 RunDll32.exe rundll32.exe PID 4252 wrote to memory of 4872 4252 RunDll32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe"C:\Users\Admin\AppData\Local\Temp\01f8dabeceaed59233438a1064bdee5ba1399041d0371ba84575968c5e672a65.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\9hPWDS.cpL",2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\9hPWDS.cpL",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\9hPWDS.cpL",4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\9hPWDS.cpL",5⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9hPWDS.cpLFilesize
1.7MB
MD52f0aa7a5e492d37bfe4c5142cc154887
SHA16b9a31dae71de99802172f4c1a9a678a7c68f9b9
SHA25670db641aa7cbea596e977298f3fce5b54662ed75ec45034e609fe27262c37bb8
SHA5126328ff70bdd889f790870ec9da0f49f3a66e437ef9d800a67998869588725815ff77d3dfb0e921cbd69d339d6cc32f069b7f2c804010ec442df4cd9f7c94ed02
-
\Users\Admin\AppData\Local\Temp\9hPWdS.cplFilesize
1.7MB
MD52f0aa7a5e492d37bfe4c5142cc154887
SHA16b9a31dae71de99802172f4c1a9a678a7c68f9b9
SHA25670db641aa7cbea596e977298f3fce5b54662ed75ec45034e609fe27262c37bb8
SHA5126328ff70bdd889f790870ec9da0f49f3a66e437ef9d800a67998869588725815ff77d3dfb0e921cbd69d339d6cc32f069b7f2c804010ec442df4cd9f7c94ed02
-
\Users\Admin\AppData\Local\Temp\9hPWdS.cplFilesize
1.7MB
MD52f0aa7a5e492d37bfe4c5142cc154887
SHA16b9a31dae71de99802172f4c1a9a678a7c68f9b9
SHA25670db641aa7cbea596e977298f3fce5b54662ed75ec45034e609fe27262c37bb8
SHA5126328ff70bdd889f790870ec9da0f49f3a66e437ef9d800a67998869588725815ff77d3dfb0e921cbd69d339d6cc32f069b7f2c804010ec442df4cd9f7c94ed02
-
memory/2196-154-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-174-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-119-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-120-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-122-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-123-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-125-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-126-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-127-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-128-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-129-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-130-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-131-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-132-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-133-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-134-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-135-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-136-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-138-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-137-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-139-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-140-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-141-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-142-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-143-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-144-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-145-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-146-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-147-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-148-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-149-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-150-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-151-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-152-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-153-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-117-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-156-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-155-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-118-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-158-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-159-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-160-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-161-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-162-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-163-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-164-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-165-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-166-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-167-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-168-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-170-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-169-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-171-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-172-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-157-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-175-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-173-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-177-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-176-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-178-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-179-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-180-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-181-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2196-182-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/3596-228-0x0000000000000000-mapping.dmp
-
memory/3596-277-0x00000000051D0000-0x00000000052E5000-memory.dmpFilesize
1.1MB
-
memory/3596-276-0x0000000004F70000-0x00000000050AB000-memory.dmpFilesize
1.2MB
-
memory/3596-343-0x00000000051D0000-0x00000000052E5000-memory.dmpFilesize
1.1MB
-
memory/4252-285-0x0000000000000000-mapping.dmp
-
memory/4872-286-0x0000000000000000-mapping.dmp
-
memory/4872-334-0x0000000005500000-0x0000000005615000-memory.dmpFilesize
1.1MB
-
memory/4872-333-0x00000000052A0000-0x00000000053DB000-memory.dmpFilesize
1.2MB
-
memory/4872-342-0x0000000005500000-0x0000000005615000-memory.dmpFilesize
1.1MB
-
memory/5108-183-0x0000000000000000-mapping.dmp