Analysis

  • max time kernel
    157s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 04:03

General

  • Target

    dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.exe

  • Size

    1.6MB

  • MD5

    364e5fafdbd20add6f67abadc82194cb

  • SHA1

    e5f8fe222d44a742d125bfbdf6ebee30fa2f7f61

  • SHA256

    dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78

  • SHA512

    95a90fc6345a990879ae8a7e3f54359446d5135e3d015218982e4453561ee1809a70225b9e224e0a5757c2d652cf71a6c781ad51c8ec71e69aac6efac667ba46

  • SSDEEP

    24576:cnTlirXbGk6aBESVXGxKdRw3yRc26XtujIEo4+l6J69bA5rV4Yihe5Cpnk:0lijbGkzukc26XtVq+lAebA5rOYiZnk

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.exe
    "C:\Users\Admin\AppData\Local\Temp\dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4072
    • C:\Users\Admin\AppData\Local\Temp\is-TP4GF.tmp\dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TP4GF.tmp\dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.tmp" /SL5="$90182,996898,70144,C:\Users\Admin\AppData\Local\Temp\dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3276

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\is-TP4GF.tmp\dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.tmp

          Filesize

          1.2MB

          MD5

          e7106fbf42fbc6d5b08a18ada4f781b4

          SHA1

          36d4a629f79d772c0b0df8bd2ae2ea09108d239d

          SHA256

          64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635

          SHA512

          adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845

        • C:\Users\Admin\AppData\Local\Temp\is-TP4GF.tmp\dae06be707f16281a3110ced18afacc65a88081c4029164e3d4e9cfb34595d78.tmp

          Filesize

          1.2MB

          MD5

          e7106fbf42fbc6d5b08a18ada4f781b4

          SHA1

          36d4a629f79d772c0b0df8bd2ae2ea09108d239d

          SHA256

          64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635

          SHA512

          adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845

        • memory/4072-132-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/4072-134-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/4072-138-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB