0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e

General

Target

0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe
Size

3.0MB
MD5

41c4db31b5ac0758f048f7f7803dd5ff
SHA1

f216f57da7d0875ff67eca8a7e05617fe936e6e9
SHA256

0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e
SHA512

074d39d3acb84285dbb671a787db3edb1ef494e1504da20bd53e49b2558307c5fbcd586d18830809ba1f2c53334eaf59f7e77364ba75392ea843ad8523e2f787
SSDEEP

49152:K2wlGP/i6wRqiA97qoLGDk1VfMnHueNLrKUpYiLtF1xVzwmzt2hqiNPCyNttF:LwlCiBQJ7qceueNfwibnVpzkh9Pb5

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
328	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Loads dropped DLL 3 IoCs

pid	Process
960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe
328	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp
328	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
328	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 328	960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	28
PID 960 wrote to memory of 328	960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	28
PID 960 wrote to memory of 328	960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	28
PID 960 wrote to memory of 328	960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	28
PID 960 wrote to memory of 328	960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	28
PID 960 wrote to memory of 328	960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	28
PID 960 wrote to memory of 328	960	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	28

C:\Users\Admin\AppData\Local\Temp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe
"C:\Users\Admin\AppData\Local\Temp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\is-2DJ13.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2DJ13.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp" /SL5="$80122,2800798,54272,C:\Users\Admin\AppData\Local\Temp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-2DJ13.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Filesize
680KB

MD5
ed69e64731547eba52476a2d2a2f7882

SHA1
cbcd56bbb5230d11a01f18e9bf59f97802bb475b

SHA256
427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0

SHA512
04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2DJ13.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Filesize
680KB

MD5
ed69e64731547eba52476a2d2a2f7882

SHA1
cbcd56bbb5230d11a01f18e9bf59f97802bb475b

SHA256
427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0

SHA512
04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe

Download Submit
\Users\Admin\AppData\Local\Temp\is-2DJ13.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Filesize
680KB

MD5
ed69e64731547eba52476a2d2a2f7882

SHA1
cbcd56bbb5230d11a01f18e9bf59f97802bb475b

SHA256
427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0

SHA512
04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe

Download Submit
\Users\Admin\AppData\Local\Temp\is-CQSRS.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-CQSRS.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/960-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/960-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/960-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing