9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f

Analysis

max time kernel
151s
max time network
173s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
Size

1.1MB
MD5

bf35ee8f8e18930ce7106017b9b549d5
SHA1

c9c34b4d9b0058b29b3301c137af8374e4861e91
SHA256

9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f
SHA512

41a54228f9ec314ed4e35c50a1840aca42fe01d896093789686390b2a4b9ece1ff8db228f49c1cc2134e711a6482f1f3cfc376f24707567e3871967d65b18d0c
SSDEEP

24576:ba0ro+BhvaQrQVgFhQi3gN62eOz7kDKP3KJkzX8+kgeAU:20ro+BhZLQi3s62bdP3KOgkeAU

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1840	ytd.exe

Loads dropped DLL 5 IoCs

pid	Process
1184	9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1184	9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1184	9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1840	ytd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000013109-62.dat	nsis_installer_1
behavioral1/files/0x0008000000013109-62.dat	nsis_installer_2
behavioral1/files/0x0008000000013109-64.dat	nsis_installer_1
behavioral1/files/0x0008000000013109-64.dat	nsis_installer_2
behavioral1/files/0x0008000000013109-66.dat	nsis_installer_1
behavioral1/files/0x0008000000013109-66.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1688	1184	9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	28
PID 1184 wrote to memory of 1688	1184	9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	28
PID 1184 wrote to memory of 1688	1184	9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	28
PID 1184 wrote to memory of 1688	1184	9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	28
PID 1688 wrote to memory of 1840	1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	31
PID 1688 wrote to memory of 1840	1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	31
PID 1688 wrote to memory of 1840	1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	31
PID 1688 wrote to memory of 1840	1688	DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe	31

C:\Users\Admin\AppData\Local\Temp\9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
"C:\Users\Admin\AppData\Local\Temp\9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\nsj7275.tmp\DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe
  "C:\Users\Admin\AppData\Local\Temp\nsj7275.tmp\DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\Install_581\ytd.exe
    C:\Users\Admin\AppData\Local\Temp\Install_581\ytd.exe /S /aff=defytd1 /rnd=7369
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Install_581\ytd.exe

Filesize
4.9MB

MD5
aab45f6b1fefd7b8e4019b94fa302588

SHA1
35fafb84026e16225484c1e798cf6882ecbbdb1c

SHA256
b65901c22495390b1327b0271b1f91b70f270627f03dc3d30e559c26a166f291

SHA512
6c6e1c781c0b874dc9dc671bca662772a69ced04fb4fe70346c3ef552be8eb0cc7774c690f95ad1a639c1250bc0ac56506aa49d8df6d0b5b5a8e9740f1b5ef5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install_581\ytd.exe

Filesize
4.9MB

MD5
aab45f6b1fefd7b8e4019b94fa302588

SHA1
35fafb84026e16225484c1e798cf6882ecbbdb1c

SHA256
b65901c22495390b1327b0271b1f91b70f270627f03dc3d30e559c26a166f291

SHA512
6c6e1c781c0b874dc9dc671bca662772a69ced04fb4fe70346c3ef552be8eb0cc7774c690f95ad1a639c1250bc0ac56506aa49d8df6d0b5b5a8e9740f1b5ef5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj7275.tmp\DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe

Filesize
1.1MB

MD5
4fc522762889b774b12572e3490811e2

SHA1
072263e208b194a019b9c6156699db7d3b5c3cac

SHA256
c3efd9bc510862b4f7512d91ee55cc0de506a806ccec442234725e07dfa8c7bf

SHA512
d5dc43c3f01c9dce69ab15dbd837c17b6c60d5049879be37cc7e8d450ebd6576c478849be379746f7f6e422d6c46edd3728ee73f294a5c6c3c4b0d327e8fcc5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj7275.tmp\DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe

Filesize
1.1MB

MD5
4fc522762889b774b12572e3490811e2

SHA1
072263e208b194a019b9c6156699db7d3b5c3cac

SHA256
c3efd9bc510862b4f7512d91ee55cc0de506a806ccec442234725e07dfa8c7bf

SHA512
d5dc43c3f01c9dce69ab15dbd837c17b6c60d5049879be37cc7e8d450ebd6576c478849be379746f7f6e422d6c46edd3728ee73f294a5c6c3c4b0d327e8fcc5c

Download Submit
\Users\Admin\AppData\Local\Temp\Install_581\ytd.exe

Filesize
4.9MB

MD5
aab45f6b1fefd7b8e4019b94fa302588

SHA1
35fafb84026e16225484c1e798cf6882ecbbdb1c

SHA256
b65901c22495390b1327b0271b1f91b70f270627f03dc3d30e559c26a166f291

SHA512
6c6e1c781c0b874dc9dc671bca662772a69ced04fb4fe70346c3ef552be8eb0cc7774c690f95ad1a639c1250bc0ac56506aa49d8df6d0b5b5a8e9740f1b5ef5e

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7275.tmp\D1989.dll

Filesize
14KB

MD5
904beebec2790ee2ca0c90fc448ac7e0

SHA1
40fabf1eb0a3b7168351c4514c5288216cb1566d

SHA256
f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

SHA512
8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7275.tmp\DC9283813216ddf468a9eb4d1d1ab55254cad082425244ee452982078322432e2f.exe

Filesize
1.1MB

MD5
4fc522762889b774b12572e3490811e2

SHA1
072263e208b194a019b9c6156699db7d3b5c3cac

SHA256
c3efd9bc510862b4f7512d91ee55cc0de506a806ccec442234725e07dfa8c7bf

SHA512
d5dc43c3f01c9dce69ab15dbd837c17b6c60d5049879be37cc7e8d450ebd6576c478849be379746f7f6e422d6c46edd3728ee73f294a5c6c3c4b0d327e8fcc5c

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7275.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
\Users\Admin\AppData\Local\Temp\nspABBD.tmp\D1958.dll

Filesize
14KB

MD5
904beebec2790ee2ca0c90fc448ac7e0

SHA1
40fabf1eb0a3b7168351c4514c5288216cb1566d

SHA256
f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

SHA512
8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

Download Submit
memory/1184-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download