d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e

Analysis

max time kernel
59s
max time network
58s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe
Size

6.0MB
MD5

eb8ec9db175de9a379370fb666c05d02
SHA1

dd96a622ca62a56c56261ad9a621931d34a5827e
SHA256

d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e
SHA512

32b4e7e7a6e9720145689624e32b3746c39e70808d29a3883fb1a6d660c6b69561e5403f732be5790a5457637d44a44b7529ffb00aa6e20de4cbcd5a91c3e82c
SSDEEP

98304:nFAwI4Npuu5kpbOM6LjKv3IMLwd25+n2tXNwTTaZ1:nFAwI4NxkpCMx3xUd25+n29N+TaZ1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

E08B5933A6578E04.exe

pid process

892 E08B5933A6578E04.exe

pid	process
892	E08B5933A6578E04.exe

Loads dropped DLL 2 IoCs

Processes:

d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe

pid	process
1340	d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe
1340	d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe

description	pid	process	target process
PID 1340 wrote to memory of 892	1340	d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe	E08B5933A6578E04.exe
PID 1340 wrote to memory of 892	1340	d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe	E08B5933A6578E04.exe
PID 1340 wrote to memory of 892	1340	d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe	E08B5933A6578E04.exe
PID 1340 wrote to memory of 892	1340	d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe	E08B5933A6578E04.exe

C:\Users\Admin\AppData\Local\Temp\d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe
"C:\Users\Admin\AppData\Local\Temp\d9d74acafd701d281fe5985fb07aad109636a31ef51125d32b1962f4ed4a0d0e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\E08B5933A6578E04.exe
  "C:\Users\Admin\AppData\Local\Temp\E08B5933A6578E04.exe" 1020
  2⤵
  - Executes dropped EXE
  PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E08B5933A6578E04.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
\Users\Admin\AppData\Local\Temp\E08B5933A6578E04.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
\Users\Admin\AppData\Local\Temp\E08B5933A6578E04.exe

Filesize
719KB

MD5
e3b8d79334b809089aa3e5b22c980085

SHA1
281d9833a060b64fc3a98150a66f85ac5345b85b

SHA256
1c0916ed47557275d46f71903806101726fd458acccc62e776580869bc1b3ca1

SHA512
cc83f4d4e0291b792561f0bf58e991b8f17ae685818ad7ab05c41aa333d38fde1b815d1d6cf62a95039385b94353b5bf6793114547a727cabb8d53dae34bf8f6

Download Submit
memory/892-66-0x0000000000000000-mapping.dmp

Download
memory/1340-57-0x0000000002AA0000-0x0000000002C78000-memory.dmp

Filesize
1.8MB

Download
memory/1340-60-0x0000000002AA0000-0x0000000002C78000-memory.dmp

Filesize
1.8MB

Download
memory/1340-61-0x0000000000400000-0x0000000000B70000-memory.dmp

Filesize
7.4MB

Download
memory/1340-62-0x0000000000400000-0x0000000000B70000-memory.dmp

Filesize
7.4MB

Download
memory/1340-63-0x0000000002AA0000-0x0000000002C78000-memory.dmp

Filesize
1.8MB

Download
memory/1340-59-0x0000000000400000-0x0000000000B70000-memory.dmp

Filesize
7.4MB

Download
memory/1340-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000002AA0000-0x0000000002C78000-memory.dmp

Filesize
1.8MB

Download
memory/1340-55-0x0000000002AA0000-0x0000000002C78000-memory.dmp

Filesize
1.8MB

Download
memory/1340-68-0x0000000000400000-0x0000000000B70000-memory.dmp

Filesize
7.4MB

Download
memory/1340-69-0x0000000002AA0000-0x0000000002C78000-memory.dmp

Filesize
1.8MB

Download