1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97

Analysis

max time kernel
133s
max time network
160s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe
Size

19KB
MD5

56a4d509c6c9274f5c8081c67246e277
SHA1

7bf6c5011b70444f8dc12bed0e0128aa0c2a8ef8
SHA256

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97
SHA512

00abc365ebf48c2584da43f7c7824f10704e68aad4ba244dd90a56ee15641d5006735cde758057cc16ae161da9ad399164a594738369d647d95148f9a86184ef
SSDEEP

192:Mmd9B9FPH1M1kTpocHSpL4cJtIo/0kIGwKaaaaOaaakAdtCZ3Wdm:Mm9PH4xUUIo/LwktGG4

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

defnx.exe

pid process

1384 defnx.exe
Deletes itself 1 IoCs

Processes:

defnx.exe

pid process

1384 defnx.exe

pid	process
1384	defnx.exe

pid	process
1384	defnx.exe

Loads dropped DLL 2 IoCs

Processes:

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe

pid	process
1244	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe
1244	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe

description	pid	process	target process
PID 1244 wrote to memory of 1384	1244	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe	defnx.exe
PID 1244 wrote to memory of 1384	1244	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe	defnx.exe
PID 1244 wrote to memory of 1384	1244	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe	defnx.exe
PID 1244 wrote to memory of 1384	1244	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe	defnx.exe

C:\Users\Admin\AppData\Local\Temp\1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe
"C:\Users\Admin\AppData\Local\Temp\1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\defnx.exe
"C:\Users\Admin\AppData\Local\Temp\defnx.exe"
2⤵
- Executes dropped EXE
- Deletes itself
PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\defnx.exe

Filesize
19KB

MD5
41129531069e47f24d9e615ba75eb36d

SHA1
718f6bae382ed8b917ddfb1dabd7b637b052b3e2

SHA256
c83d5e31ac3cab0406c84e535af72c7ac7822e4cb3637d1482ef22c39d455c15

SHA512
109317bf557dae04e0f046adb1b2df28ee78619842959dabb643c23a3b5efd9d87bf05ba81daeec0f019b5bb13404473b2db80fdbe5c119fa7a96ea8a0b53af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\defnx.exe

Filesize
19KB

MD5
41129531069e47f24d9e615ba75eb36d

SHA1
718f6bae382ed8b917ddfb1dabd7b637b052b3e2

SHA256
c83d5e31ac3cab0406c84e535af72c7ac7822e4cb3637d1482ef22c39d455c15

SHA512
109317bf557dae04e0f046adb1b2df28ee78619842959dabb643c23a3b5efd9d87bf05ba81daeec0f019b5bb13404473b2db80fdbe5c119fa7a96ea8a0b53af7

Download Submit
\Users\Admin\AppData\Local\Temp\defnx.exe

Filesize
19KB

MD5
41129531069e47f24d9e615ba75eb36d

SHA1
718f6bae382ed8b917ddfb1dabd7b637b052b3e2

SHA256
c83d5e31ac3cab0406c84e535af72c7ac7822e4cb3637d1482ef22c39d455c15

SHA512
109317bf557dae04e0f046adb1b2df28ee78619842959dabb643c23a3b5efd9d87bf05ba81daeec0f019b5bb13404473b2db80fdbe5c119fa7a96ea8a0b53af7

Download Submit
\Users\Admin\AppData\Local\Temp\defnx.exe

Filesize
19KB

MD5
41129531069e47f24d9e615ba75eb36d

SHA1
718f6bae382ed8b917ddfb1dabd7b637b052b3e2

SHA256
c83d5e31ac3cab0406c84e535af72c7ac7822e4cb3637d1482ef22c39d455c15

SHA512
109317bf557dae04e0f046adb1b2df28ee78619842959dabb643c23a3b5efd9d87bf05ba81daeec0f019b5bb13404473b2db80fdbe5c119fa7a96ea8a0b53af7

Download Submit
memory/1244-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1384-57-0x0000000000000000-mapping.dmp

Download