6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d

Analysis

max time kernel
132s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
Size

794KB
MD5

fbaa69c44cf521e048bd775727783259
SHA1

75e112f724247375b327709b33956ff518597e07
SHA256

6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d
SHA512

71c8f10a4aef10e5bff25c60a1b266440dae8d5e97bb35c33e340235ca1cf0b27b3542fdb83a0764466b4356fb1d99c63808fd9c218d0318821248b82eebc56c
SSDEEP

24576:4ueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+W:4uCTsdRBZbDxQqRRdfc3MncVoD+W

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
940	launch.exe
1756	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Loads dropped DLL 2 IoCs

pid	Process
1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000800000001232e-73.dat	nsis_installer_1
behavioral1/files/0x000800000001232e-73.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
1756	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 940	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	28
PID 1488 wrote to memory of 940	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	28
PID 1488 wrote to memory of 940	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	28
PID 1488 wrote to memory of 940	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	28
PID 1488 wrote to memory of 940	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	28
PID 1488 wrote to memory of 940	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	28
PID 1488 wrote to memory of 940	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	28
PID 1488 wrote to memory of 1756	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	29
PID 1488 wrote to memory of 1756	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	29
PID 1488 wrote to memory of 1756	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	29
PID 1488 wrote to memory of 1756	1488	6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe	29

C:\Users\Admin\AppData\Local\Temp\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
"C:\Users\Admin\AppData\Local\Temp\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "e6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe" "6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe
  C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe /path="C:\Users\Admin\AppData\Local\Temp\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\e6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Filesize
325KB

MD5
13ee1c03daec55875db9808cebbfff5d

SHA1
e182704191ee3277c20d73d5d47a3774d8c978a8

SHA256
134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d

SHA512
36c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\installer.exe

Filesize
794KB

MD5
fbaa69c44cf521e048bd775727783259

SHA1
75e112f724247375b327709b33956ff518597e07

SHA256
6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d

SHA512
71c8f10a4aef10e5bff25c60a1b266440dae8d5e97bb35c33e340235ca1cf0b27b3542fdb83a0764466b4356fb1d99c63808fd9c218d0318821248b82eebc56c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
\Users\Admin\AppData\Local\Temp\DM\6df6c8109597ff94b8e8eebd4cec63c06dd306933c2e2cbee565b0fa9efc115d.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/940-64-0x0000000073900000-0x0000000073EAB000-memory.dmp

Filesize
5.7MB

Download
memory/940-62-0x0000000073900000-0x0000000073EAB000-memory.dmp

Filesize
5.7MB

Download
memory/1488-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1488-55-0x0000000073F91000-0x0000000073F93000-memory.dmp

Filesize
8KB

Download
memory/1756-70-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Filesize
10.1MB

Download
memory/1756-71-0x000007FEF2BB0000-0x000007FEF3C46000-memory.dmp

Filesize
16.6MB

Download
memory/1756-72-0x0000000000A86000-0x0000000000AA5000-memory.dmp

Filesize
124KB

Download