Analysis
-
max time kernel
186s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:45
Static task
static1
Behavioral task
behavioral1
Sample
87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
Resource
win10v2004-20221111-en
General
-
Target
87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe
-
Size
187KB
-
MD5
e91b2aaec7e5d16446ab97516613ba0c
-
SHA1
61da1f2dd15904288e58a157ec21108ceb3b81ae
-
SHA256
87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40
-
SHA512
2fad92ae4d1b056ade036890dc958c60eaa4c1af41656c2d723a097108c2288a4534a3e4ec874bc6252c59715106ef07fa549d314e3f6d17e816aec825614220
-
SSDEEP
3072:gBUIYrsgIDmJxsug57s6z31Zi/y3X7+J8x+zbaRDk7J9MhW6y7OD0Dp3OnWTSSpt:gGsbug57s6D1Y6ym+zok7J9MPyiD4p+Q
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exedescription ioc process File created C:\Windows\SysWOW64\drivers\acpidisk.sys 87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe File opened for modification C:\Windows\SysWOW64\drivers\acpidisk.sys 87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe -
Loads dropped DLL 4 IoCs
Processes:
87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exepid process 2896 87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe 2896 87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe 2896 87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe 2896 87c4b23a3f49a60d68d4223244a238972df0f0a994e7a72d9f284e8b3c5d4c40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dosss11.dllFilesize
68KB
MD5e81de89b6a3226156e9c0cf2cc9a18d5
SHA168d0a0fe141ee858f85d73756be97321e17a03c4
SHA2561b970b97594ecd94a19963b89976c2c51f8c63080802ee0a756edd5b43203e2a
SHA5122b9bc3e50dc655bccabc75d6d4079bd1682688b29acf9c64ee599a8a6f52b55737b4386d399a624ac23269933113ab82ae3015c2717cefed200d3717a8832340
-
C:\Users\Admin\AppData\Local\Temp\dosss11.dllFilesize
68KB
MD5e81de89b6a3226156e9c0cf2cc9a18d5
SHA168d0a0fe141ee858f85d73756be97321e17a03c4
SHA2561b970b97594ecd94a19963b89976c2c51f8c63080802ee0a756edd5b43203e2a
SHA5122b9bc3e50dc655bccabc75d6d4079bd1682688b29acf9c64ee599a8a6f52b55737b4386d399a624ac23269933113ab82ae3015c2717cefed200d3717a8832340
-
C:\Users\Admin\AppData\Local\Temp\nsg4940.tmp\System.dllFilesize
10KB
MD5bf01b2d04e8fad306ba2f364cfc4edfa
SHA158f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA256d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
SHA51230ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7
-
C:\Users\Admin\AppData\Local\Temp\nsg4940.tmp\System.dllFilesize
10KB
MD5bf01b2d04e8fad306ba2f364cfc4edfa
SHA158f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA256d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
SHA51230ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7
-
memory/2896-136-0x00000000025F0000-0x0000000002603000-memory.dmpFilesize
76KB