7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe
Size

795KB
MD5

1dfd45c0afa2562614463286dd836910
SHA1

43f8a51b2522662339d966f88d786bf80c06ec84
SHA256

7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9
SHA512

9ffeafbe0bf5d8fb685bc611392e0f0ff082e70ff1b4c4fb0f3b56c8d49b4a2de4e9a619dc67a819c0320c3ed2e3a69f8486e1b397e8e12e116c4625d658f5b7
SSDEEP

24576:BueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+U:BuCTsdRBZbDxQqRRdfc3MncVoD+U

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1992	launch.exe
1752	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Loads dropped DLL 2 IoCs

pid	Process
1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe
1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000012313-73.dat	nsis_installer_1
behavioral1/files/0x0008000000012313-73.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1752	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe
1752	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1992	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	27
PID 1696 wrote to memory of 1992	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	27
PID 1696 wrote to memory of 1992	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	27
PID 1696 wrote to memory of 1992	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	27
PID 1696 wrote to memory of 1992	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	27
PID 1696 wrote to memory of 1992	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	27
PID 1696 wrote to memory of 1992	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	27
PID 1696 wrote to memory of 1752	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	28
PID 1696 wrote to memory of 1752	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	28
PID 1696 wrote to memory of 1752	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	28
PID 1696 wrote to memory of 1752	1696	7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe	28

C:\Users\Admin\AppData\Local\Temp\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe
"C:\Users\Admin\AppData\Local\Temp\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "e7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe" "7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe
  C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe /path="C:\Users\Admin\AppData\Local\Temp\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\e7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Filesize
325KB

MD5
13ee1c03daec55875db9808cebbfff5d

SHA1
e182704191ee3277c20d73d5d47a3774d8c978a8

SHA256
134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d

SHA512
36c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\installer.exe

Filesize
795KB

MD5
1dfd45c0afa2562614463286dd836910

SHA1
43f8a51b2522662339d966f88d786bf80c06ec84

SHA256
7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9

SHA512
9ffeafbe0bf5d8fb685bc611392e0f0ff082e70ff1b4c4fb0f3b56c8d49b4a2de4e9a619dc67a819c0320c3ed2e3a69f8486e1b397e8e12e116c4625d658f5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
\Users\Admin\AppData\Local\Temp\DM\7b2cd5c89884194fc721c91824c6f8dc3df30d67ca24b0fc663d1b3f186006c9.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000074D51000-0x0000000074D53000-memory.dmp

Filesize
8KB

Download
memory/1752-70-0x000007FEF4930000-0x000007FEF5353000-memory.dmp

Filesize
10.1MB

Download
memory/1752-71-0x000007FEEE160000-0x000007FEEF1F6000-memory.dmp

Filesize
16.6MB

Download
memory/1752-72-0x00000000021A6000-0x00000000021C5000-memory.dmp

Filesize
124KB

Download
memory/1992-64-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-62-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download