2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d

Analysis

max time kernel
133s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
Size

63KB
MD5

917e09110e1125c5bbf095e6ce7e3237
SHA1

d5878d817ad210fbae27715835fc1d5e1d05fd6f
SHA256

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d
SHA512

aa2b6974a3def96e8c69943695962b17a078bde309f9f938d515e5bb19c247e00cdb4e9dcb472743faa4dfc126fc7b36d0d009c6b6580f2cc9dc3f25ed6265ba
SSDEEP

1536:cumhxebkJf+FTXJLzr+lOdj2cPD2aXFmMtu:cuxkZuTXJKMdjJ6aXFmM8

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mf.exeef.exe

pid process

1648 mf.exe
1464 ef.exe

pid	process
1648	mf.exe
1464	ef.exe

Loads dropped DLL 18 IoCs

Processes:

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exemf.exeef.exe

pid	process
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
1648	mf.exe
1648	mf.exe
1648	mf.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
1464	ef.exe
1464	ef.exe
1464	ef.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe

description	pid	process	target process
PID 2036 wrote to memory of 1648	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 2036 wrote to memory of 1648	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 2036 wrote to memory of 1648	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 2036 wrote to memory of 1648	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 2036 wrote to memory of 1648	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 2036 wrote to memory of 1648	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 2036 wrote to memory of 1648	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	mf.exe
PID 2036 wrote to memory of 1464	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 2036 wrote to memory of 1464	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 2036 wrote to memory of 1464	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 2036 wrote to memory of 1464	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 2036 wrote to memory of 1464	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 2036 wrote to memory of 1464	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe
PID 2036 wrote to memory of 1464	2036	2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe	ef.exe

C:\Users\Admin\AppData\Local\Temp\2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe
"C:\Users\Admin\AppData\Local\Temp\2e547209654b7756c2cff3a7dc29c44d06f9e1f81cbff529b1126e804474ea0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe "C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648

C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe "C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll" -968
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll.out
Filesize
20KB

MD5
89d90cbab6d0718cfea2bb1865f0dc28

SHA1
bd947ae55ae1a95a3c2423300f6b4f8398d23c79

SHA256
4bc01e1cbbe34b80c8c9daf6e4a5a346250dae8c6ec73db26acf6085d7b1e962

SHA512
f95ca2dc462a419458e5c0ce6140d2fe9a689817faee7bc8a87fbe7da4a4e423784616cfc20bf65ad55d3d18a6dd4662639ec83cb0220a041d79b6cc304422c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll.out
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll.out0
Filesize
10KB

MD5
4f1bc6b4466a9b84113842660e7de483

SHA1
04d05739c6ed3df896626d59d5391a699cf8cb11

SHA256
9764622c9bb81321763b246a71f6e337e082457655f660d705d83b868eb550d1

SHA512
9e2ce520010cdd390f8f1c8004795b3618e7ad1fd538b20fbfcf031495ecc6841ec9a6f21d16a963c35569aa7ecc40ecc1b0fba152c0a35ad998a2a743e96d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll.out1
Filesize
10KB

MD5
37068846f9ee2ebd355b27b0abf0e6fc

SHA1
6fb5eb553ccfa74751ba4c7a5381b125fb829f02

SHA256
fba508e890edb803f6a2323cffa332ba13577c3957d57d31de6bcafa11b5070c

SHA512
ada09d0bb0a8f523c892144328cfcaa8d8f0f94049ed10edca92713134f9ca0d3f68ed384ab8b3b8e6f55a6462d6181ab0a7e7df617f04d3e31c1fb06af00ce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\ef.exe
Filesize
2KB

MD5
b8a00d99534bf83442b20b2474b767cf

SHA1
505d3f6591db0f87a73a0ac820cc2eba5171cfff

SHA256
cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6

SHA512
75df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\inetc.dll
Filesize
20KB

MD5
e541458cfe66ef95ffbea40eaaa07289

SHA1
caec1233f841ee72004231a3027b13cdeb13274c

SHA256
3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

SHA512
0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\mf.exe
Filesize
2KB

MD5
224df7127c7ee69e67380eefc983a6ff

SHA1
236c342c5bd1f71725534d097fcd8538dd95aa56

SHA256
9ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965

SHA512
c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst893F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
memory/1464-72-0x0000000000000000-mapping.dmp

Download
memory/1648-59-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download