e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208

Analysis

max time kernel
214s
max time network
301s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe
Size

794KB
MD5

0bb0799c53a3311667148b801b6e8de0
SHA1

e8144870cc693915ad16802e473c885410fbc88e
SHA256

e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208
SHA512

aaab34905fc90f052f91f5e3e2b150501c6ed56647e2aba8087417fa58b169a62505c62b3f00fb28f563b35107957d0a0e51101a8d9a2552a8baa7a605f6c344
SSDEEP

24576:huefYT/hmflRBmqPeQ93D4AQASnE9VnX/vcGs:huFTsdRBZbDxQASnET/vcGs

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1532	launch.exe
1476	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Loads dropped DLL 2 IoCs

pid	Process
752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe
752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00080000000136d5-73.dat	nsis_installer_1
behavioral1/files/0x00080000000136d5-73.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1476	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe
1476	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1532	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	28
PID 752 wrote to memory of 1532	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	28
PID 752 wrote to memory of 1532	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	28
PID 752 wrote to memory of 1532	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	28
PID 752 wrote to memory of 1532	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	28
PID 752 wrote to memory of 1532	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	28
PID 752 wrote to memory of 1532	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	28
PID 752 wrote to memory of 1476	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	29
PID 752 wrote to memory of 1476	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	29
PID 752 wrote to memory of 1476	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	29
PID 752 wrote to memory of 1476	752	e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe	29

C:\Users\Admin\AppData\Local\Temp\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe
"C:\Users\Admin\AppData\Local\Temp\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\launch.exe "ee2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe" "e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe" "936d475e3aaa4dcca54a487a8bcce5c6" dec
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe
  C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe /path="C:\Users\Admin\AppData\Local\Temp\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\ee2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Filesize
325KB

MD5
5878afd32f2c56a933f2dfba27e2844f

SHA1
341bd1d2e6ab5bb0b09fae17d36af8532102e726

SHA256
f5fff848e6e6cd04da3782e94a352ad2256c30c79da25752ead38ade4fb801a6

SHA512
eda462b07e112ef4d9e80cf68e489796f0f4371f3c164e826a538026c518c26fe0466284ff68e57b3d99682e91745efd5f2e2d35ece3ebdc89cec71e745b1d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\installer.exe

Filesize
794KB

MD5
0bb0799c53a3311667148b801b6e8de0

SHA1
e8144870cc693915ad16802e473c885410fbc88e

SHA256
e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208

SHA512
aaab34905fc90f052f91f5e3e2b150501c6ed56647e2aba8087417fa58b169a62505c62b3f00fb28f563b35107957d0a0e51101a8d9a2552a8baa7a605f6c344

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
\Users\Admin\AppData\Local\Temp\DM\e2b66190944246c49f7cfffa3296e2690e951226010165b055acf92f7efcb208.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/752-55-0x0000000074101000-0x0000000074103000-memory.dmp

Filesize
8KB

Download
memory/752-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/1476-70-0x000007FEF3180000-0x000007FEF3BA3000-memory.dmp

Filesize
10.1MB

Download
memory/1476-71-0x000007FEF1EA0000-0x000007FEF2F36000-memory.dmp

Filesize
16.6MB

Download
memory/1476-72-0x0000000000B36000-0x0000000000B55000-memory.dmp

Filesize
124KB

Download
memory/1532-64-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download
memory/1532-62-0x0000000073780000-0x0000000073D2B000-memory.dmp

Filesize
5.7MB

Download