a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59

Analysis

max time kernel
182s
max time network
208s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:40

Target

a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe
Size

21KB
MD5

dca91aa843ee50a20186d08dff81e5f6
SHA1

da577716dd9d7c0b8ca5316b8526a1c8c4ac3574
SHA256

a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59
SHA512

68c6c267c820233ecbff8fc1c358bfa3777506ca49ebc970c825f5102297aa4aaacf2609a19d57c3b9834878f86a0bfadc8f86514aee5ce7f2b51c04ee37fe73
SSDEEP

384:XoU6XoFlRrEFZmw0yZZfPYmbYr14ZN8Jv:XNlZEFQw0yZpPbib

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

dyhfw.exe

pid process

1492 dyhfw.exe
Deletes itself 1 IoCs

Processes:

dyhfw.exe

pid process

1492 dyhfw.exe
Loads dropped DLL 1 IoCs

Processes:

a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe

pid process

1408 a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1492	dyhfw.exe

pid	process
1492	dyhfw.exe

pid	process
1408	a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe

description	pid	process	target process
PID 1408 wrote to memory of 1492	1408	a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe	dyhfw.exe
PID 1408 wrote to memory of 1492	1408	a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe	dyhfw.exe
PID 1408 wrote to memory of 1492	1408	a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe	dyhfw.exe
PID 1408 wrote to memory of 1492	1408	a42fad2d41ffaf212ad212c8b3fb100c2c9a60294fbb5f52805f98d89b6d4d59.exe	dyhfw.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\Temp\dyhfw.exe
Filesize
21KB

MD5
167dad315f1d37021f36d009e52aba38

SHA1
1ed9cadb8057bbf7db20ccb14b4ef363c82ae373

SHA256
4b8b9189b878e85438b74f210b673094b3bd419db07af8a34c43196709e206a2

SHA512
7302f40fc25e9a2a7bbc7940204716c9d5bdc6ec2c1c1244c43a344895c7387038f6b747342e90da50245df2bcac1eb4d325316ad2bb7ee2b86e1eb5eda45a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\dyhfw.exe
Filesize
21KB

MD5
167dad315f1d37021f36d009e52aba38

SHA1
1ed9cadb8057bbf7db20ccb14b4ef363c82ae373

SHA256
4b8b9189b878e85438b74f210b673094b3bd419db07af8a34c43196709e206a2

SHA512
7302f40fc25e9a2a7bbc7940204716c9d5bdc6ec2c1c1244c43a344895c7387038f6b747342e90da50245df2bcac1eb4d325316ad2bb7ee2b86e1eb5eda45a45

Download Submit
\Users\Admin\AppData\Local\Temp\dyhfw.exe
Filesize
21KB

MD5
167dad315f1d37021f36d009e52aba38

SHA1
1ed9cadb8057bbf7db20ccb14b4ef363c82ae373

SHA256
4b8b9189b878e85438b74f210b673094b3bd419db07af8a34c43196709e206a2

SHA512
7302f40fc25e9a2a7bbc7940204716c9d5bdc6ec2c1c1244c43a344895c7387038f6b747342e90da50245df2bcac1eb4d325316ad2bb7ee2b86e1eb5eda45a45

Download Submit
memory/1408-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1408-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1492-56-0x0000000000000000-mapping.dmp

Download
memory/1492-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download