b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe
Size

2.7MB
MD5

cc659c5862e7d1930dcb47dd11a7e178
SHA1

6a9971919d7da42673876007be393fa18155a30f
SHA256

b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7
SHA512

46fd2ac20c7009f1b43a56ffc4ff16587fa3099b7e13eb1e68f1e8bc8622520b58b46e8b70461f6234880526333ee40584b696a117402a724db0b83e7eb15e0e
SSDEEP

49152:kGU6QNADYFM9klsMwZfoikxZNS0Cu1EAP0Pre2ksomJqMIY0ng91LGSDsEyizNx6:ZU3yYeSsMOkbLCz+2k4AnuLGM1r6

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1268	is-ID7UI.tmp

Loads dropped DLL 3 IoCs

pid	Process
1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe
1268	is-ID7UI.tmp
1268	is-ID7UI.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1268	1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	27
PID 1348 wrote to memory of 1268	1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	27
PID 1348 wrote to memory of 1268	1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	27
PID 1348 wrote to memory of 1268	1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	27
PID 1348 wrote to memory of 1268	1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	27
PID 1348 wrote to memory of 1268	1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	27
PID 1348 wrote to memory of 1268	1348	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	27

C:\Users\Admin\AppData\Local\Temp\b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe
"C:\Users\Admin\AppData\Local\Temp\b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\is-OVTBC.tmp\is-ID7UI.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OVTBC.tmp\is-ID7UI.tmp" /SL4 $70122 "C:\Users\Admin\AppData\Local\Temp\b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe" 2610169 51200
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-OVTBC.tmp\is-ID7UI.tmp

Filesize
649KB

MD5
897787d6abd66a5f10927d8fb6645f55

SHA1
f6106753adb23afd105e3b677f8b6c005812e850

SHA256
a68a96927d72c5a0be27b3a9c6a70f35c4c495167e76813a81febe586d547c1f

SHA512
7488348ddf93c3251321db47bda22be0df18aeff0d407c1cfb483855be724cc333b212810c4123a672bd2e70cc2734a83f952c24f553dbfeacd14d48f922262c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OVTBC.tmp\is-ID7UI.tmp

Filesize
649KB

MD5
897787d6abd66a5f10927d8fb6645f55

SHA1
f6106753adb23afd105e3b677f8b6c005812e850

SHA256
a68a96927d72c5a0be27b3a9c6a70f35c4c495167e76813a81febe586d547c1f

SHA512
7488348ddf93c3251321db47bda22be0df18aeff0d407c1cfb483855be724cc333b212810c4123a672bd2e70cc2734a83f952c24f553dbfeacd14d48f922262c

Download Submit
\Users\Admin\AppData\Local\Temp\is-987FG.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
0486e6bc79c359800fa5168e2bbd0ac3

SHA1
cfbebf90b35890330c179bab218b16811c2db9cf

SHA256
fde9d7d1d8845080605b3244bd7bb4298bd5d03e408a56c82a2485f10424a200

SHA512
5c9e13f7946e9efaf91a65ae3d4a03ecc135f0eea34777863c7ca5a4b7cc4cd1bc72fd6afc575f9cc24bcfe2675ce968c3801df293032b7f01600a972ed51af3

Download Submit
\Users\Admin\AppData\Local\Temp\is-987FG.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
0486e6bc79c359800fa5168e2bbd0ac3

SHA1
cfbebf90b35890330c179bab218b16811c2db9cf

SHA256
fde9d7d1d8845080605b3244bd7bb4298bd5d03e408a56c82a2485f10424a200

SHA512
5c9e13f7946e9efaf91a65ae3d4a03ecc135f0eea34777863c7ca5a4b7cc4cd1bc72fd6afc575f9cc24bcfe2675ce968c3801df293032b7f01600a972ed51af3

Download Submit
\Users\Admin\AppData\Local\Temp\is-OVTBC.tmp\is-ID7UI.tmp

Filesize
649KB

MD5
897787d6abd66a5f10927d8fb6645f55

SHA1
f6106753adb23afd105e3b677f8b6c005812e850

SHA256
a68a96927d72c5a0be27b3a9c6a70f35c4c495167e76813a81febe586d547c1f

SHA512
7488348ddf93c3251321db47bda22be0df18aeff0d407c1cfb483855be724cc333b212810c4123a672bd2e70cc2734a83f952c24f553dbfeacd14d48f922262c

Download Submit
memory/1268-58-0x0000000000000000-mapping.dmp

Download
memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1348-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1348-59-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download