97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14

Analysis

max time kernel
152s
max time network
199s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
Size

699KB
MD5

c872c970f3490e1a5cec665ced0a5e9b
SHA1

42c6e3bde1c74bbfe294b73f9c014cbe9b4a6a32
SHA256

97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14
SHA512

e1c7d587b20410d7dcf7fd69766a5f21b77265435228c6a88b385f3bb31bb5caf812c0519aa9ca3dfcc861c1c8d3dd3d6a6ffba2f4565cb6b366fae40b67ccda
SSDEEP

12288:Duud4ptYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfQ9fUQ27W+yoszFjMTeWGt:Due4YT/hmflRBmqPeQ93D4AQI9f2oz8c

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1744	launch.exe
796	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Loads dropped DLL 3 IoCs

pid	Process
832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00080000000126df-74.dat	nsis_installer_1
behavioral1/files/0x00080000000126df-74.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
796	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
796	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1744	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	28
PID 832 wrote to memory of 1744	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	28
PID 832 wrote to memory of 1744	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	28
PID 832 wrote to memory of 1744	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	28
PID 832 wrote to memory of 1744	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	28
PID 832 wrote to memory of 1744	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	28
PID 832 wrote to memory of 1744	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	28
PID 832 wrote to memory of 796	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	29
PID 832 wrote to memory of 796	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	29
PID 832 wrote to memory of 796	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	29
PID 832 wrote to memory of 796	832	97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe	29

C:\Users\Admin\AppData\Local\Temp\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
"C:\Users\Admin\AppData\Local\Temp\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe "e97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe" "97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe" "5799b77b367146d4a32112752349ed38" dec
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe
  C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe /path="C:\Users\Admin\AppData\Local\Temp\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Filesize
223KB

MD5
1d417f92be7a5a2c5bb3b1897e152695

SHA1
ed31727207fe529f94a21c8163c97c908775a249

SHA256
8c535c92d33c79f06c0af6eb00a6b4ef0dac7bbdcef26aeea629d15e51f0c7ef

SHA512
34049c1168f729f1dbc1b58f487fa16c5730ced8b29acf2b950b38f6927bb0429fa116c2e4cb02cd0858ce7c24e3d511ce94eb685eeb6131598cf86a403a6321

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Filesize
223KB

MD5
1d417f92be7a5a2c5bb3b1897e152695

SHA1
ed31727207fe529f94a21c8163c97c908775a249

SHA256
8c535c92d33c79f06c0af6eb00a6b4ef0dac7bbdcef26aeea629d15e51f0c7ef

SHA512
34049c1168f729f1dbc1b58f487fa16c5730ced8b29acf2b950b38f6927bb0429fa116c2e4cb02cd0858ce7c24e3d511ce94eb685eeb6131598cf86a403a6321

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\e97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Filesize
223KB

MD5
128e8c7b314ac671a94e69f37d2c1f78

SHA1
e8100a7d109605ec52babb8c8db1ecf5a3ffa952

SHA256
22d90ebb68dfea9f56bdcbf9909e226e7f4978371b2b28eba044f68fa652558e

SHA512
002de39a566cbb11873c9a6adcee8901acce240c080feb5c52f799f377654beff9bf2d634e30cb1b345b4f54260048198b2d2c3aaf549d554f124d7cc92b6087

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\installer.exe

Filesize
699KB

MD5
c872c970f3490e1a5cec665ced0a5e9b

SHA1
42c6e3bde1c74bbfe294b73f9c014cbe9b4a6a32

SHA256
97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14

SHA512
e1c7d587b20410d7dcf7fd69766a5f21b77265435228c6a88b385f3bb31bb5caf812c0519aa9ca3dfcc861c1c8d3dd3d6a6ffba2f4565cb6b366fae40b67ccda

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe

Filesize
223KB

MD5
1d417f92be7a5a2c5bb3b1897e152695

SHA1
ed31727207fe529f94a21c8163c97c908775a249

SHA256
8c535c92d33c79f06c0af6eb00a6b4ef0dac7bbdcef26aeea629d15e51f0c7ef

SHA512
34049c1168f729f1dbc1b58f487fa16c5730ced8b29acf2b950b38f6927bb0429fa116c2e4cb02cd0858ce7c24e3d511ce94eb685eeb6131598cf86a403a6321

Download Submit
\Users\Admin\AppData\Local\Temp\DM\97a35a32f26af71e9e9d5c623eec6ec1b289cf69c07e4223b3ac5a7026d5dd14.exe\5cf3f9feda1e4281a21db03c450700f9\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
\Users\Admin\AppData\Local\Temp\nsyCD9D.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
memory/796-71-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp

Filesize
10.1MB

Download
memory/796-73-0x0000000001EE6000-0x0000000001F05000-memory.dmp

Filesize
124KB

Download
memory/796-72-0x000007FEF2A80000-0x000007FEF3B16000-memory.dmp

Filesize
16.6MB

Download
memory/832-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/832-56-0x00000000740C1000-0x00000000740C3000-memory.dmp

Filesize
8KB

Download
memory/1744-65-0x0000000073A00000-0x0000000073FAB000-memory.dmp

Filesize
5.7MB

Download
memory/1744-63-0x0000000073A00000-0x0000000073FAB000-memory.dmp

Filesize
5.7MB

Download