44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
Size

14.1MB
MD5

419235366d5c965c79117a403bb6c5da
SHA1

83dc365418c4d26e431870f70d3947c3a747c9cb
SHA256

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567
SHA512

8282affe35350624ad60e95dd445238d681fcfdded9255c81e2a89009333fb43784a09acc5f725f41be0fb1e488fd7ae3144c0b95f855e3697fe5d441a877d6f
SSDEEP

393216:tjaiKK9iT3xU1eWWm/U7dUr9MExK09uAGcZuVgBhg:ty8OoWhdUrjxKiuAVwVsg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

is-EIT5U.tmp

pid process

1296 is-EIT5U.tmp
Loads dropped DLL 3 IoCs

Processes:

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exeis-EIT5U.tmp

pid process

908 44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
1296 is-EIT5U.tmp
1296 is-EIT5U.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1296	is-EIT5U.tmp

pid	process
908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
1296	is-EIT5U.tmp
1296	is-EIT5U.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe

description	pid	process	target process
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp
PID 908 wrote to memory of 1296	908	44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe	is-EIT5U.tmp

C:\Users\Admin\AppData\Local\Temp\44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe
"C:\Users\Admin\AppData\Local\Temp\44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:908

C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp" /SL4 $60124 "C:\Users\Admin\AppData\Local\Temp\44667004c4984c42bfac4176fed27c34ca00cf360e03612c4742a4d835543567.exe" 14522061 49664
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp

Filesize
639KB

MD5
c0720d08873ecc235edc7ac9c515d793

SHA1
28bf8b33e5daac25438ca75b3384a44a024eff4b

SHA256
62eba329580b2d813c117ebddb74422ed9b09b1b23edc669a0ea3bc41518b671

SHA512
2d48ef2c2aafa7872ddc6d577fe7b45f901604e53abe12968cb29f51e9c18b8371e9e328481611081d47d64e1a6b00a557ca7e23b8aec711398455832e3ebe06

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp

Filesize
639KB

MD5
c0720d08873ecc235edc7ac9c515d793

SHA1
28bf8b33e5daac25438ca75b3384a44a024eff4b

SHA256
62eba329580b2d813c117ebddb74422ed9b09b1b23edc669a0ea3bc41518b671

SHA512
2d48ef2c2aafa7872ddc6d577fe7b45f901604e53abe12968cb29f51e9c18b8371e9e328481611081d47d64e1a6b00a557ca7e23b8aec711398455832e3ebe06

Download Submit
\Users\Admin\AppData\Local\Temp\is-6OTDG.tmp\is-EIT5U.tmp

Filesize
639KB

MD5
c0720d08873ecc235edc7ac9c515d793

SHA1
28bf8b33e5daac25438ca75b3384a44a024eff4b

SHA256
62eba329580b2d813c117ebddb74422ed9b09b1b23edc669a0ea3bc41518b671

SHA512
2d48ef2c2aafa7872ddc6d577fe7b45f901604e53abe12968cb29f51e9c18b8371e9e328481611081d47d64e1a6b00a557ca7e23b8aec711398455832e3ebe06

Download Submit
\Users\Admin\AppData\Local\Temp\is-83FTT.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
b05cd5cd1c0968db5766fba7c9b13a69

SHA1
29fa5f9e394704b4ee0bace2b8c17aea2d5769c5

SHA256
6489865bf98963bbdc269d0744492d418882db47962b50264cf9b168ae7a2cc3

SHA512
e7b0d9a1009f3f57106eb2205d53d1580639f29fbf96991754e4d979bb61faf74bd62bac636164cf73381e30a48527792dc9e8c86747491d8b946aa9a0c464dd

Download Submit
\Users\Admin\AppData\Local\Temp\is-83FTT.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
b05cd5cd1c0968db5766fba7c9b13a69

SHA1
29fa5f9e394704b4ee0bace2b8c17aea2d5769c5

SHA256
6489865bf98963bbdc269d0744492d418882db47962b50264cf9b168ae7a2cc3

SHA512
e7b0d9a1009f3f57106eb2205d53d1580639f29fbf96991754e4d979bb61faf74bd62bac636164cf73381e30a48527792dc9e8c86747491d8b946aa9a0c464dd

Download Submit
memory/908-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/908-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/908-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1296-57-0x0000000000000000-mapping.dmp

Download