44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
Size

14.1MB
MD5

419235366d5c965c79117a403bb6c5da
SHA1

83dc365418c4d26e431870f70d3947c3a747c9cb
SHA256

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567
SHA512

8282affe35350624ad60e95dd445238d681fcfdded9255c81e2a89009333fb43784a09acc5f725f41be0fb1e488fd7ae3144c0b95f855e3697fe5d441a877d6f
SSDEEP

393216:tjaiKK9iT3xU1eWWm/U7dUr9MExK09uAGcZuVgBhg:ty8OoWhdUrjxKiuAVwVsg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

is-EIT5U.tmp

pid process

1296 is-EIT5U.tmp
Loads dropped DLL 3 IoCs

Processes:

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exeis-EIT5U.tmp

pid process

908 44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
1296 is-EIT5U.tmp
1296 is-EIT5U.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1296	is-EIT5U.tmp

pid	process
908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
1296	is-EIT5U.tmp
1296	is-EIT5U.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe

description	pid	process	target process
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp

C:\Users\Admin\AppData\Local\Temp\44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
"C:\Users\Admin\AppData\Local\Temp\44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:908

C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp" /SL4 $60124 "C:\Users\Admin\AppData\Local\Temp\44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe" 14522061 49664
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp
Filesize
639KB

MD5
c0720d08873ecc235edc7ac9c515d793

SHA1
28bf8b33e5daac25438ca75b3384a44a024eff4b

SHA256
62eba329580b2d813c117ebddb74422ed9b09b1b23edc669a0ea3bc41518b671

SHA512
2d48ef2c2aafa7872ddc6d577fe7b45f901604e53abe12968cb29f51e9c18b8371e9e328481611081d47d64e1a6b00a557ca7e23b8aec711398455832e3ebe06

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp
Filesize
639KB

MD5
c0720d08873ecc235edc7ac9c515d793

SHA1
28bf8b33e5daac25438ca75b3384a44a024eff4b

SHA256
62eba329580b2d813c117ebddb74422ed9b09b1b23edc669a0ea3bc41518b671

SHA512
2d48ef2c2aafa7872ddc6d577fe7b45f901604e53abe12968cb29f51e9c18b8371e9e328481611081d47d64e1a6b00a557ca7e23b8aec711398455832e3ebe06

Download Submit
\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp
Filesize
639KB

MD5
c0720d08873ecc235edc7ac9c515d793

SHA1
28bf8b33e5daac25438ca75b3384a44a024eff4b

SHA256
62eba329580b2d813c117ebddb74422ed9b09b1b23edc669a0ea3bc41518b671

SHA512
2d48ef2c2aafa7872ddc6d577fe7b45f901604e53abe12968cb29f51e9c18b8371e9e328481611081d47d64e1a6b00a557ca7e23b8aec711398455832e3ebe06

Download Submit
\Users\Admin\AppData\Local\Temp\is-83FTT.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
b05cd5cd1c0968db5766fba7c9b13a69

SHA1
29fa5f9e394704b4ee0bace2b8c17aea2d5769c5

SHA256
6489865bf98963bbdc269d0744492d418882db47962b50264cf9b168ae7a2cc3

SHA512
e7b0d9a1009f3f57106eb2205d53d1580639f29fbf96991754e4d979bb61faf74bd62bac636164cf73381e30a48527792dc9e8c86747491d8b946aa9a0c464dd

Download Submit
\Users\Admin\AppData\Local\Temp\is-83FTT.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
b05cd5cd1c0968db5766fba7c9b13a69

SHA1
29fa5f9e394704b4ee0bace2b8c17aea2d5769c5

SHA256
6489865bf98963bbdc269d0744492d418882db47962b50264cf9b168ae7a2cc3

SHA512
e7b0d9a1009f3f57106eb2205d53d1580639f29fbf96991754e4d979bb61faf74bd62bac636164cf73381e30a48527792dc9e8c86747491d8b946aa9a0c464dd

Download Submit
memory/908-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/908-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/908-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1296-57-0x0000000000000000-mapping.dmp

Download