Analysis
-
max time kernel
149s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 04:17
Static task
static1
Behavioral task
behavioral1
Sample
3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe
Resource
win10v2004-20221111-en
General
-
Target
3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe
-
Size
741KB
-
MD5
0a263ad79c2fe90290a9c1ceae15b619
-
SHA1
e92a62eabe0c9a8d821c846dc2486efa6b51d881
-
SHA256
3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0
-
SHA512
1ff3a37140f378709f983f608993728cdf50c8566b7eff1200dd5b05e1fa35e1311778fe26fd7277b70efa1ac17c3ee08e6f7f7a01726701afc455a15891c49d
-
SSDEEP
12288:z0gnKoeV4SkXmoPaxN4yvk6D/P+H9IIBMazvCYlsIuvcmdP0eeC85o6vyqfd1+1D:AgKL/6moMP7DP+H9IwsIuvZdMeKz51+x
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 1668 Au_.exe -
Loads dropped DLL 2 IoCs
Processes:
Au_.exepid process 1668 Au_.exe 1668 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exedescription pid process target process PID 1072 wrote to memory of 1668 1072 3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe Au_.exe PID 1072 wrote to memory of 1668 1072 3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe Au_.exe PID 1072 wrote to memory of 1668 1072 3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe Au_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe"C:\Users\Admin\AppData\Local\Temp\3fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsy10D9.tmp\System.dllFilesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
C:\Users\Admin\AppData\Local\Temp\nsy10D9.tmp\nsDialogs.dllFilesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeFilesize
741KB
MD50a263ad79c2fe90290a9c1ceae15b619
SHA1e92a62eabe0c9a8d821c846dc2486efa6b51d881
SHA2563fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0
SHA5121ff3a37140f378709f983f608993728cdf50c8566b7eff1200dd5b05e1fa35e1311778fe26fd7277b70efa1ac17c3ee08e6f7f7a01726701afc455a15891c49d
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeFilesize
741KB
MD50a263ad79c2fe90290a9c1ceae15b619
SHA1e92a62eabe0c9a8d821c846dc2486efa6b51d881
SHA2563fdcf68ac21226f1b55b15e780c9698b4dc802acf18747ced06850e8016fa2c0
SHA5121ff3a37140f378709f983f608993728cdf50c8566b7eff1200dd5b05e1fa35e1311778fe26fd7277b70efa1ac17c3ee08e6f7f7a01726701afc455a15891c49d
-
memory/1668-132-0x0000000000000000-mapping.dmp