855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e

Analysis

max time kernel
151s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe
Size

90KB
MD5

115cb19644cf409c7f9558411736fb56
SHA1

3f10bbb62f0f9e9b26e5b9dd5f26700b3df800be
SHA256

855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e
SHA512

2ad5984bee010bd2447a4da9a22ff6c0ecff21349c84f51772f4e290e99fe604b5ecec4a870d2ba5e46664734806ddc541dcaec6605d416165557c45cc600cf4
SSDEEP

1536:5ofZjoekm2T0XepZnvxEO0HMFBx4qWxzNJjCryG/ZHW9rC38tnsTvYsqbssX:5oxjodUezv6/kx4XNJjCryGBHm1tdsM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
952	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
1964	855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe
952	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
952	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 952	1964	855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe	28
PID 1964 wrote to memory of 952	1964	855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe	28
PID 1964 wrote to memory of 952	1964	855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe	28
PID 1964 wrote to memory of 952	1964	855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe	28

C:\Users\Admin\AppData\Local\Temp\855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe
"C:\Users\Admin\AppData\Local\Temp\855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
90KB

MD5
115cb19644cf409c7f9558411736fb56

SHA1
3f10bbb62f0f9e9b26e5b9dd5f26700b3df800be

SHA256
855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e

SHA512
2ad5984bee010bd2447a4da9a22ff6c0ecff21349c84f51772f4e290e99fe604b5ecec4a870d2ba5e46664734806ddc541dcaec6605d416165557c45cc600cf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
90KB

MD5
115cb19644cf409c7f9558411736fb56

SHA1
3f10bbb62f0f9e9b26e5b9dd5f26700b3df800be

SHA256
855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e

SHA512
2ad5984bee010bd2447a4da9a22ff6c0ecff21349c84f51772f4e290e99fe604b5ecec4a870d2ba5e46664734806ddc541dcaec6605d416165557c45cc600cf4

Download Submit
\Users\Admin\AppData\Local\Temp\nst96F5.tmp\LangDLL.dll

Filesize
5KB

MD5
51e7fd0885b7d7bf6edc030e17145950

SHA1
be7a62d254f897789cde5b9a77a8b3b0add6d141

SHA256
1a56dfe0bdae779b40d11b9caee5c96e81b9d69b0d45be7c7b11717e1db8c5a5

SHA512
a57c57a3d01839df10ab669bead1d757ef85e4a35cac65a3a147c5e1adaccaae52bb355ed8d4d460a6698cbda3ee8fba395875739670c8cf57884f66306d011a

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
90KB

MD5
115cb19644cf409c7f9558411736fb56

SHA1
3f10bbb62f0f9e9b26e5b9dd5f26700b3df800be

SHA256
855d1b82ec569e3ea454bc5f9354041bc90cbe53b4d988ef617d8c1de5a2ac4e

SHA512
2ad5984bee010bd2447a4da9a22ff6c0ecff21349c84f51772f4e290e99fe604b5ecec4a870d2ba5e46664734806ddc541dcaec6605d416165557c45cc600cf4

Download Submit
memory/1964-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download