88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223

Analysis

max time kernel
33s
max time network
65s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:20

Target

88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223.exe
Size

116KB
MD5

eb66549b348dbeeee5c887e8bd70d25f
SHA1

d486d3ecf7b735e0e2807dd4dc4f4a38bf78f6a9
SHA256

88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223
SHA512

30452a2caeb9e11e5c6ef34d91005d1c17ba589b6279fd8ad03e0c51eda5431a6991c23a1c777b620e60bc39997a69b51ee2a8d8e7b8f372b938b229af39eaaf
SSDEEP

3072:SEruu/ZRHSn0gl5ITg/hUm5AmQYAF8ZJJZXMCcx:bbcrl5IsXC8rJV

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

LocalOoJPoRtNlt.exe

pid process

1772 LocalOoJPoRtNlt.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1772	LocalOoJPoRtNlt.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223.exe

description	pid	process	target process
PID 1396 wrote to memory of 1772	1396	88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223.exe	LocalOoJPoRtNlt.exe
PID 1396 wrote to memory of 1772	1396	88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223.exe	LocalOoJPoRtNlt.exe
PID 1396 wrote to memory of 1772	1396	88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223.exe	LocalOoJPoRtNlt.exe

C:\Users\Admin\AppData\Local\Temp\88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223.exe
"C:\Users\Admin\AppData\Local\Temp\88273c1e64e138eb104caf1c28f0e5c0f718c3bb00f191a91b3544fdf0f91223.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\LocalOoJPoRtNlt.exe
"C:\Users\Admin\AppData\LocalOoJPoRtNlt.exe"
2⤵
- Executes dropped EXE
PID:1772

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\LocalOoJPoRtNlt.exe

Filesize
16KB

MD5
2288662c817ae8006087b71ca1ae8235

SHA1
137141c396a6f6506d83781b2ef68a9ed81efe1f

SHA256
b3164b50f842a651470ecbb9fbcde3b9bb1341f21a6d5df08ae267e7298d3bdb

SHA512
52915510eae172327f543850e19a2ac0ad8afa72a2d09e13a9293b8dc5fc47692ab8d7413062be74d32151d93d2bb3823b780eb94b8a3b8e8a38d6df3b041ad0

Download Submit
C:\Users\Admin\AppData\LocalOoJPoRtNlt.exe

Filesize
16KB

MD5
2288662c817ae8006087b71ca1ae8235

SHA1
137141c396a6f6506d83781b2ef68a9ed81efe1f

SHA256
b3164b50f842a651470ecbb9fbcde3b9bb1341f21a6d5df08ae267e7298d3bdb

SHA512
52915510eae172327f543850e19a2ac0ad8afa72a2d09e13a9293b8dc5fc47692ab8d7413062be74d32151d93d2bb3823b780eb94b8a3b8e8a38d6df3b041ad0

Download Submit
memory/1396-54-0x000007FEF35D0000-0x000007FEF3FF3000-memory.dmp

Filesize
10.1MB

Download
memory/1396-55-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download
memory/1396-60-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

Filesize
64KB

Download
memory/1772-56-0x0000000000000000-mapping.dmp

Download
memory/1772-59-0x000007FEF35D0000-0x000007FEF3FF3000-memory.dmp

Filesize
10.1MB

Download