83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe
Size

594KB
MD5

a0434ed2b30fd40cc1ccee15d8a09428
SHA1

a7526d1990c080e9a8d7ad0fb080b4260813b2ec
SHA256

83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312
SHA512

84438fb35c2c96950754923c0a7ea259222e189b1e409efb16a6b549eb9618449b865fba2366f285e6b5c9592be1cc3aafadd8b41011bf597ad6d8b54b3e7b64
SSDEEP

12288:0dany/AY0jwwTpZNbNPVS7sOs6HiXgKy/ryhVbiSGN+gAPOK7kEieo:MamV0jww9LNwQV6HrKy/G7+AbLo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
848	INS4931.tmp

Loads dropped DLL 2 IoCs

pid	Process
1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe
1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 848	1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe	28
PID 1616 wrote to memory of 848	1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe	28
PID 1616 wrote to memory of 848	1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe	28
PID 1616 wrote to memory of 848	1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe	28
PID 1616 wrote to memory of 848	1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe	28
PID 1616 wrote to memory of 848	1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe	28
PID 1616 wrote to memory of 848	1616	83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe	28

C:\Users\Admin\AppData\Local\Temp\83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe
"C:\Users\Admin\AppData\Local\Temp\83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\INS4931.tmp
  C:\Users\Admin\AppData\Local\Temp\INS4931.tmp /SL C:\Users\Admin\AppData\Local\Temp\83fbf38877de5c6f41dfb9d79f48f39164444fb3eaf1b9c173c3e1a549fb8312.exe 607170 68096
  2⤵
  - Executes dropped EXE
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\INS4931.tmp

Filesize
364KB

MD5
153a3eff359636e8bd326ebf7052ea74

SHA1
3e5ee2ab849a0031e22c0936268c0ba7fa264fbf

SHA256
9b74eb76245d5e5b46ce2613b8a88be3bae4bf01223955196dff73c37d829bc9

SHA512
fe746ab5c599e2e550cd852e6fa149ffee7d382dc1a5c9edef791babc2914ab9656dc3484e739a0b230a05281e470efc64df1beda6b2074b888c7586af90fdad

Download Submit
C:\Users\Admin\AppData\Local\Temp\INS4931.tmp

Filesize
364KB

MD5
153a3eff359636e8bd326ebf7052ea74

SHA1
3e5ee2ab849a0031e22c0936268c0ba7fa264fbf

SHA256
9b74eb76245d5e5b46ce2613b8a88be3bae4bf01223955196dff73c37d829bc9

SHA512
fe746ab5c599e2e550cd852e6fa149ffee7d382dc1a5c9edef791babc2914ab9656dc3484e739a0b230a05281e470efc64df1beda6b2074b888c7586af90fdad

Download Submit
\Users\Admin\AppData\Local\Temp\INS4931.tmp

Filesize
364KB

MD5
153a3eff359636e8bd326ebf7052ea74

SHA1
3e5ee2ab849a0031e22c0936268c0ba7fa264fbf

SHA256
9b74eb76245d5e5b46ce2613b8a88be3bae4bf01223955196dff73c37d829bc9

SHA512
fe746ab5c599e2e550cd852e6fa149ffee7d382dc1a5c9edef791babc2914ab9656dc3484e739a0b230a05281e470efc64df1beda6b2074b888c7586af90fdad

Download Submit
\Users\Admin\AppData\Local\Temp\INS4931.tmp

Filesize
364KB

MD5
153a3eff359636e8bd326ebf7052ea74

SHA1
3e5ee2ab849a0031e22c0936268c0ba7fa264fbf

SHA256
9b74eb76245d5e5b46ce2613b8a88be3bae4bf01223955196dff73c37d829bc9

SHA512
fe746ab5c599e2e550cd852e6fa149ffee7d382dc1a5c9edef791babc2914ab9656dc3484e739a0b230a05281e470efc64df1beda6b2074b888c7586af90fdad

Download Submit
memory/1616-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download