Analysis

  • max time kernel
    93s
  • max time network
    59s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-11-2022 09:13

General

  • Target

    87a6c5ac34356043974d8823f7ce33625b0d7572871f78e2be161f3c7ac18e5f.exe

  • Size

    1.6MB

  • MD5

    84419b2756957698c872721d1ac263b7

  • SHA1

    b5d6e463ceafde3c71e13889b650141b274ae5c0

  • SHA256

    87a6c5ac34356043974d8823f7ce33625b0d7572871f78e2be161f3c7ac18e5f

  • SHA512

    59dc0471c397dafe8721d6a27baebdbda54b5d4b74ff2e88d3d346c9991139c39255ab62e519b879dea4d8e603342b12973340bd275d486381ca9cf5c2d53a1f

  • SSDEEP

    24576:b062cSEk8zNlLsRTgLszgM5EXiMfxtaqbuohAGbwMcgxpVO7u7gNej5o0LS4zEWi:A6PaECg0ZMfnAcOipQYKe1TSW0zmw

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87a6c5ac34356043974d8823f7ce33625b0d7572871f78e2be161f3c7ac18e5f.exe
    "C:\Users\Admin\AppData\Local\Temp\87a6c5ac34356043974d8823f7ce33625b0d7572871f78e2be161f3c7ac18e5f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" .\XM46.8S
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\XM46.8S
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3364
        • C:\Windows\system32\RunDll32.exe
          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\XM46.8S
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\XM46.8S
            5⤵
            • Loads dropped DLL
            PID:4528

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\XM46.8S

    Filesize

    1.7MB

    MD5

    7f8754fc25a0ec481a1eaff4357b1742

    SHA1

    fdf1b6deb01bc9c9c1b800aa57682d09a8cad4d2

    SHA256

    7e00b9e62357606515b32642669df6ecf0c33215f576cc21907b314ee95836d7

    SHA512

    413de4a8bbc6edeafd30993a4fc8f0a85bbc94eb76fb48a1d6fedf016eff54c7a1c1b02632516d616a346c2690810e1ca6b8d33b26fc7f1f73513f53c3f2dd6b

  • \Users\Admin\AppData\Local\Temp\xM46.8s

    Filesize

    1.7MB

    MD5

    7f8754fc25a0ec481a1eaff4357b1742

    SHA1

    fdf1b6deb01bc9c9c1b800aa57682d09a8cad4d2

    SHA256

    7e00b9e62357606515b32642669df6ecf0c33215f576cc21907b314ee95836d7

    SHA512

    413de4a8bbc6edeafd30993a4fc8f0a85bbc94eb76fb48a1d6fedf016eff54c7a1c1b02632516d616a346c2690810e1ca6b8d33b26fc7f1f73513f53c3f2dd6b

  • \Users\Admin\AppData\Local\Temp\xM46.8s

    Filesize

    1.7MB

    MD5

    7f8754fc25a0ec481a1eaff4357b1742

    SHA1

    fdf1b6deb01bc9c9c1b800aa57682d09a8cad4d2

    SHA256

    7e00b9e62357606515b32642669df6ecf0c33215f576cc21907b314ee95836d7

    SHA512

    413de4a8bbc6edeafd30993a4fc8f0a85bbc94eb76fb48a1d6fedf016eff54c7a1c1b02632516d616a346c2690810e1ca6b8d33b26fc7f1f73513f53c3f2dd6b

  • \Users\Admin\AppData\Local\Temp\xM46.8s

    Filesize

    1.7MB

    MD5

    7f8754fc25a0ec481a1eaff4357b1742

    SHA1

    fdf1b6deb01bc9c9c1b800aa57682d09a8cad4d2

    SHA256

    7e00b9e62357606515b32642669df6ecf0c33215f576cc21907b314ee95836d7

    SHA512

    413de4a8bbc6edeafd30993a4fc8f0a85bbc94eb76fb48a1d6fedf016eff54c7a1c1b02632516d616a346c2690810e1ca6b8d33b26fc7f1f73513f53c3f2dd6b

  • \Users\Admin\AppData\Local\Temp\xM46.8s

    Filesize

    1.7MB

    MD5

    7f8754fc25a0ec481a1eaff4357b1742

    SHA1

    fdf1b6deb01bc9c9c1b800aa57682d09a8cad4d2

    SHA256

    7e00b9e62357606515b32642669df6ecf0c33215f576cc21907b314ee95836d7

    SHA512

    413de4a8bbc6edeafd30993a4fc8f0a85bbc94eb76fb48a1d6fedf016eff54c7a1c1b02632516d616a346c2690810e1ca6b8d33b26fc7f1f73513f53c3f2dd6b

  • memory/2124-157-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-178-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-125-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-126-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-128-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-129-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-130-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-131-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-132-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-133-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-134-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-135-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-136-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-137-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-138-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-139-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-140-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-141-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-142-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-143-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-144-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-145-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-146-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-147-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-148-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-149-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-150-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-151-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-152-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-153-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-154-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-155-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-156-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-122-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-158-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-159-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-161-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-160-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-123-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-163-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-164-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-165-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-166-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-167-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-168-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-169-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-170-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-171-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-173-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-174-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-172-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-175-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-176-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-177-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-162-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-179-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-180-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-181-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-182-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-183-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-184-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-120-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2124-121-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB

  • memory/2780-288-0x0000000000000000-mapping.dmp

  • memory/3364-279-0x0000000004AA0000-0x0000000004BDB000-memory.dmp

    Filesize

    1.2MB

  • memory/3364-280-0x0000000004D00000-0x0000000004E15000-memory.dmp

    Filesize

    1.1MB

  • memory/3364-229-0x0000000000000000-mapping.dmp

  • memory/3364-350-0x0000000004D00000-0x0000000004E15000-memory.dmp

    Filesize

    1.1MB

  • memory/4528-289-0x0000000000000000-mapping.dmp

  • memory/4528-338-0x0000000004750000-0x000000000488B000-memory.dmp

    Filesize

    1.2MB

  • memory/4528-339-0x00000000049B0000-0x0000000004AC5000-memory.dmp

    Filesize

    1.1MB

  • memory/4528-347-0x00000000049B0000-0x0000000004AC5000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-185-0x0000000000000000-mapping.dmp

  • memory/4868-186-0x0000000077710000-0x000000007789E000-memory.dmp

    Filesize

    1.6MB