7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9

General

Target

7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe
Size

794KB
MD5

bbdf2bcbd92a288024130238272d4ae3
SHA1

efb3ad14dd93d2210d6cc1ecc5c016ccf45b22de
SHA256

7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9
SHA512

ffca2af473f79ce6d157de1d1f5ed367225ae63c837b2a405b3f38f339b25fd712401d36b80f1b06aff3b941d048eb3182c9401289af6228e554894f0a760cd4
SSDEEP

24576:huefYT/hmflRBmqPeQ93D4AQASnE9VnX/vcGO:huFTsdRBZbDxQASnET/vcGO

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4056	launch.exe
2256	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000022e4b-147.dat	nsis_installer_1
behavioral2/files/0x0007000000022e4b-147.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
32	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2256	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe
2256	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 4056	32	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe	85
PID 32 wrote to memory of 4056	32	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe	85
PID 32 wrote to memory of 4056	32	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe	85
PID 32 wrote to memory of 2256	32	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe	96
PID 32 wrote to memory of 2256	32	7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe	96

C:\Users\Admin\AppData\Local\Temp\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe
"C:\Users\Admin\AppData\Local\Temp\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:32
- C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\launch.exe "e7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe" "7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe" "936d475e3aaa4dcca54a487a8bcce5c6" dec
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe
  C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe /path="C:\Users\Admin\AppData\Local\Temp\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\e7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe

Filesize
325KB

MD5
5878afd32f2c56a933f2dfba27e2844f

SHA1
341bd1d2e6ab5bb0b09fae17d36af8532102e726

SHA256
f5fff848e6e6cd04da3782e94a352ad2256c30c79da25752ead38ade4fb801a6

SHA512
eda462b07e112ef4d9e80cf68e489796f0f4371f3c164e826a538026c518c26fe0466284ff68e57b3d99682e91745efd5f2e2d35ece3ebdc89cec71e745b1d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\installer.exe

Filesize
794KB

MD5
bbdf2bcbd92a288024130238272d4ae3

SHA1
efb3ad14dd93d2210d6cc1ecc5c016ccf45b22de

SHA256
7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9

SHA512
ffca2af473f79ce6d157de1d1f5ed367225ae63c837b2a405b3f38f339b25fd712401d36b80f1b06aff3b941d048eb3182c9401289af6228e554894f0a760cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7c0cac6781f4e9497cae79047028f4fcd79e8df6fbacfd282bc9061b74b19da9.exe\edb808b20e17488db0caef3203e64515\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
memory/2256-144-0x00007FF9BED20000-0x00007FF9BF756000-memory.dmp

Filesize
10.2MB

Download
memory/2256-145-0x00000000006AA000-0x00000000006AF000-memory.dmp

Filesize
20KB

Download
memory/2256-146-0x00000000006AA000-0x00000000006AF000-memory.dmp

Filesize
20KB

Download
memory/4056-139-0x0000000072FF0000-0x00000000735A1000-memory.dmp

Filesize
5.7MB

Download
memory/4056-137-0x0000000072FF0000-0x00000000735A1000-memory.dmp

Filesize
5.7MB

Download
memory/4056-136-0x0000000072FF0000-0x00000000735A1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing