87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40

Analysis

max time kernel
34s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
Size

187KB
MD5

e91b2aaec7e5d16446ab97516613ba0c
SHA1

61da1f2dd15904288e58a157ec21108ceb3b81ae
SHA256

87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40
SHA512

2fad92ae4d1b056ade036890dc958c60eaa4c1af41656c2d723a097108c2288a4534a3e4ec874bc6252c59715106ef07fa549d314e3f6d17e816aec825614220
SSDEEP

3072:gBUIYrsgIDmJxsug57s6z31Zi/y3X7+J8x+zbaRDk7J9MhW6y7OD0Dp3OnWTSSpt:gGsbug57s6D1Y6ym+zok7J9MPyiD4p+Q

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\acpidisk.sys	87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
File opened for modification	C:\Windows\SysWOW64\drivers\acpidisk.sys	87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe

Loads dropped DLL 3 IoCs

Processes:

87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe

pid	process
1976	87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
1976	87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
1976	87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

C:\Users\Admin\AppData\Local\Temp\87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
"C:\Users\Admin\AppData\Local\Temp\87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
PID:1976

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dosss11.dll
Filesize
68KB

MD5
e81de89b6a3226156e9c0cf2cc9a18d5

SHA1
68d0a0fe141ee858f85d73756be97321e17a03c4

SHA256
1b970b97594ecd94a19963b89976c2c51f8c63080802ee0a756edd5b43203e2a

SHA512
2b9bc3e50dc655bccabc75d6d4079bd1682688b29acf9c64ee599a8a6f52b55737b4386d399a624ac23269933113ab82ae3015c2717cefed200d3717a8832340

Download Submit
\Users\Admin\AppData\Local\Temp\nsy63E4.tmp\System.dll
Filesize
10KB

MD5
bf01b2d04e8fad306ba2f364cfc4edfa

SHA1
58f42b45ca9fc1818c4498ecd8bac088d20f2b18

SHA256
d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903

SHA512
30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

Download Submit
\Users\Admin\AppData\Local\Temp\nsy63E4.tmp\System.dll
Filesize
10KB

MD5
bf01b2d04e8fad306ba2f364cfc4edfa

SHA1
58f42b45ca9fc1818c4498ecd8bac088d20f2b18

SHA256
d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903

SHA512
30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

Download Submit
memory/1976-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1976-58-0x0000000000DA0000-0x0000000000DB3000-memory.dmp

Filesize
76KB

Download