daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1

Analysis

max time kernel
150s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

112.exe
Size

187KB
MD5

1b16b152c1fde08b8089adf6132f5d4d
SHA1

025f3f3760221f62415376ac2ecb6bd8d426762e
SHA256

1fc0ea9775d1a71a08af06b83e829664b19a9122ce0dfececfc205aa72fcbc44
SHA512

7af997e7b9daa383f6956d9c267ae14d83c223a625a47d5c5c7b9a1391c04332f4315d0ae314d2ab7ea1648c9db2d3b60251e431d288909dd9f31ce8cddaff4e
SSDEEP

3072:EDQkrZoosbIfXJMq6WLs0JiG3VU2wBOZfYyqUElu/UvymUPPGwuDjwauVxrITZFE:EDpoeCOLNHFU2COZfYyTElu86mpFwa6/

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2576	112.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 5052	2576	112.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 5052	2576	112.exe	82
PID 2576 wrote to memory of 5052	2576	112.exe	82
PID 2576 wrote to memory of 5052	2576	112.exe	82
PID 2576 wrote to memory of 5052	2576	112.exe	82
PID 2576 wrote to memory of 5052	2576	112.exe	82
PID 2576 wrote to memory of 5052	2576	112.exe	82
PID 2576 wrote to memory of 5052	2576	112.exe	82
PID 2576 wrote to memory of 5052	2576	112.exe	82

C:\Users\Admin\AppData\Local\Temp\112.exe
"C:\Users\Admin\AppData\Local\Temp\112.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\112.exe
  "C:\Users\Admin\AppData\Local\Temp\112.exe"
  2⤵
  PID:5052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsrE48B.tmp\brokerages.dll

Filesize
16KB

MD5
1236c52aeb7ff29f443d50e4d326d0d1

SHA1
ee19d4a6a2ed9985b691b851ac0caba3268b0981

SHA256
8aba0509facbd46831ce38a569acf5909efd5c0a84aeca1fe80774b9879ed5b2

SHA512
89831f7fd674c92ef2ff08a711d326170324d0cfa0064dd38a0063b27986b4f4e7ecb538ab5bb816c8cc3059fe25bdceadc8452f40e08874f6e46c1b14dfbd17

Download Submit
memory/5052-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5052-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download