70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995

Analysis

max time kernel
254s
max time network
345s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe
Size

19KB
MD5

19b2552be7e6ffee0881705650ebb155
SHA1

9ce62cbb4e20a23ab89b4d2b63fcb571a1a7f8b4
SHA256

70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995
SHA512

fea7759998529083099629de9b43d9763b854b957b1b0cac54ceb0e18ed528f0ae84b339ff378b4e726b0ec2f89c282c82d96854bc59c9c09ddb2b8d5cf3226c
SSDEEP

192:h6IC9B9FFnuZi4polNYf5NIEaS6e5Mbb8O0F+Q1H638I9+51OZ:+FhlENIEapeGb7c+Q1H63VzZ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

mclkc.exe

pid process

1180 mclkc.exe
Deletes itself 1 IoCs

Processes:

mclkc.exe

pid process

1180 mclkc.exe

pid	process
1180	mclkc.exe

pid	process
1180	mclkc.exe

Loads dropped DLL 2 IoCs

Processes:

70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe

pid	process
1240	70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe
1240	70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe

description	pid	process	target process
PID 1240 wrote to memory of 1180	1240	70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe	mclkc.exe
PID 1240 wrote to memory of 1180	1240	70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe	mclkc.exe
PID 1240 wrote to memory of 1180	1240	70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe	mclkc.exe
PID 1240 wrote to memory of 1180	1240	70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe	mclkc.exe

C:\Users\Admin\AppData\Local\Temp\70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe
"C:\Users\Admin\AppData\Local\Temp\70e9c6eb610060e489ab54804466093a5c2b41ec54b14cd8da3e09e0d5d81995.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240

C:\Users\Admin\AppData\Local\Temp\mclkc.exe
"C:\Users\Admin\AppData\Local\Temp\mclkc.exe"
2⤵
- Executes dropped EXE
- Deletes itself
PID:1180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mclkc.exe
Filesize
19KB

MD5
a76bce669f45f1ab1bca633f1409cd18

SHA1
3566d2a80f79de7afee4d1b6235c96c24f580e5b

SHA256
128c9b09d88116ee4c2c36b22850d6a12035864162b320638fa091999c7c3a31

SHA512
fe490c1761b5603321cef9526cbee13b574762e49fe1f0c3730cff8dab271141e8900b682a94e8cf7a4f29f2f806515886a842f8c25271a035fc8084cd014ee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\mclkc.exe
Filesize
19KB

MD5
a76bce669f45f1ab1bca633f1409cd18

SHA1
3566d2a80f79de7afee4d1b6235c96c24f580e5b

SHA256
128c9b09d88116ee4c2c36b22850d6a12035864162b320638fa091999c7c3a31

SHA512
fe490c1761b5603321cef9526cbee13b574762e49fe1f0c3730cff8dab271141e8900b682a94e8cf7a4f29f2f806515886a842f8c25271a035fc8084cd014ee1

Download Submit
\Users\Admin\AppData\Local\Temp\mclkc.exe
Filesize
19KB

MD5
a76bce669f45f1ab1bca633f1409cd18

SHA1
3566d2a80f79de7afee4d1b6235c96c24f580e5b

SHA256
128c9b09d88116ee4c2c36b22850d6a12035864162b320638fa091999c7c3a31

SHA512
fe490c1761b5603321cef9526cbee13b574762e49fe1f0c3730cff8dab271141e8900b682a94e8cf7a4f29f2f806515886a842f8c25271a035fc8084cd014ee1

Download Submit
\Users\Admin\AppData\Local\Temp\mclkc.exe
Filesize
19KB

MD5
a76bce669f45f1ab1bca633f1409cd18

SHA1
3566d2a80f79de7afee4d1b6235c96c24f580e5b

SHA256
128c9b09d88116ee4c2c36b22850d6a12035864162b320638fa091999c7c3a31

SHA512
fe490c1761b5603321cef9526cbee13b574762e49fe1f0c3730cff8dab271141e8900b682a94e8cf7a4f29f2f806515886a842f8c25271a035fc8084cd014ee1

Download Submit
memory/1180-57-0x0000000000000000-mapping.dmp

Download
memory/1240-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download