daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1

Analysis

max time kernel
193s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

116.exe
Size

475KB
MD5

5693b49732f95de6062b19b6aea6d5b5
SHA1

fe2266c677a09e28fb86016331371976c133e7fd
SHA256

30ac74e39be0cf57579fbffbda9138386b2eefd45eac6df28da251d43a0d3d42
SHA512

fa7cb7f97b728322280a652d2f49735bf49daf47f5af6d50789c95d53979971255774bbadcf03a32e481dac17ec5e4905ab0221658f47ffdc12bc1a0727b80db
SSDEEP

6144:1DpoeHt8QJCUN0C7Py1av5oam+vqFvmkHf3HZHLhSk2cKgL:ZtVTN0C7PyktXVVk2cbL

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1232	116.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 2972	1232	116.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2972	1232	116.exe	82
PID 1232 wrote to memory of 2972	1232	116.exe	82
PID 1232 wrote to memory of 2972	1232	116.exe	82
PID 1232 wrote to memory of 2972	1232	116.exe	82
PID 1232 wrote to memory of 2972	1232	116.exe	82
PID 1232 wrote to memory of 2972	1232	116.exe	82
PID 1232 wrote to memory of 2972	1232	116.exe	82
PID 1232 wrote to memory of 2972	1232	116.exe	82

C:\Users\Admin\AppData\Local\Temp\116.exe
"C:\Users\Admin\AppData\Local\Temp\116.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\116.exe
  "C:\Users\Admin\AppData\Local\Temp\116.exe"
  2⤵
  PID:2972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl55C3.tmp\lichenologist.dll

Filesize
66KB

MD5
42e4078c829a2e1d2734b0033847d2cc

SHA1
5f0279f9190c168d345e024f1e4b8739aec63cfc

SHA256
4cb8de133b9d26ba4d41ed9b4bae121e4b86760805d89f97331e2b5cbb4670b2

SHA512
56be830839f3a728cf844c1656a3cad1aed77d71754d5350b7133f4b02e5c947bcae5be23d7668f13255779ed8e51cc3001b831c76d777cb9e88343d23c093f2

Download Submit
memory/2972-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2972-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download