5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5

Analysis

max time kernel
56s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe
Size

1.6MB
MD5

de2c6b665fe9725b7730cb57505b314a
SHA1

f08733fd0bd5225e32f5d0169cbe0da00c7dec11
SHA256

5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5
SHA512

348366a14a4b7139224d6026abe263bc85d64eca12439f80be90dff37db56cd71be1351958d01b3cb1335fe32aa867b187160791f6e2297d34d87d01ae369d27
SSDEEP

49152:P6dH9vQY62jKBJ2np+o3tDYeqG1BTR2dbCOovDH:SddvQQjcJ+ltDYOtMCOAH

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1696	is-VJNLV.tmp

Loads dropped DLL 3 IoCs

pid	Process
1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe
1696	is-VJNLV.tmp
1696	is-VJNLV.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1696	1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe	28
PID 1032 wrote to memory of 1696	1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe	28
PID 1032 wrote to memory of 1696	1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe	28
PID 1032 wrote to memory of 1696	1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe	28
PID 1032 wrote to memory of 1696	1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe	28
PID 1032 wrote to memory of 1696	1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe	28
PID 1032 wrote to memory of 1696	1032	5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe	28

C:\Users\Admin\AppData\Local\Temp\5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe
"C:\Users\Admin\AppData\Local\Temp\5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\is-GLVP5.tmp\is-VJNLV.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GLVP5.tmp\is-VJNLV.tmp" /SL4 $60124 "C:\Users\Admin\AppData\Local\Temp\5c838c77b453ff93269fb364276ca81af138362804fd39e2473f4e4a40e47de5.exe" 1393634 184320
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-GLVP5.tmp\is-VJNLV.tmp

Filesize
764KB

MD5
de70ce727229805d73d2dbb75a089f4e

SHA1
e6245d4458b428c1eecadf833bd663e4d3613b0d

SHA256
ca5ef93c2d84b764b1dca02e1320cd4f6e50bdbfd55e7b524f0ab677634c74f6

SHA512
2dca93d9517da9832bab9e61835c625b2ca0a30b0ec1f527eb4f7d07b04d3f297b1a533bcbe3a1309c7b03c669132bf25ffac1abf6842e22facc85723f1c370e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GLVP5.tmp\is-VJNLV.tmp

Filesize
764KB

MD5
de70ce727229805d73d2dbb75a089f4e

SHA1
e6245d4458b428c1eecadf833bd663e4d3613b0d

SHA256
ca5ef93c2d84b764b1dca02e1320cd4f6e50bdbfd55e7b524f0ab677634c74f6

SHA512
2dca93d9517da9832bab9e61835c625b2ca0a30b0ec1f527eb4f7d07b04d3f297b1a533bcbe3a1309c7b03c669132bf25ffac1abf6842e22facc85723f1c370e

Download Submit
\Users\Admin\AppData\Local\Temp\is-5ABF4.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-5ABF4.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-GLVP5.tmp\is-VJNLV.tmp

Filesize
764KB

MD5
de70ce727229805d73d2dbb75a089f4e

SHA1
e6245d4458b428c1eecadf833bd663e4d3613b0d

SHA256
ca5ef93c2d84b764b1dca02e1320cd4f6e50bdbfd55e7b524f0ab677634c74f6

SHA512
2dca93d9517da9832bab9e61835c625b2ca0a30b0ec1f527eb4f7d07b04d3f297b1a533bcbe3a1309c7b03c669132bf25ffac1abf6842e22facc85723f1c370e

Download Submit
memory/1032-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1032-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1032-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1032-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download