0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e

Analysis

max time kernel
184s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe
Size

3.0MB
MD5

41c4db31b5ac0758f048f7f7803dd5ff
SHA1

f216f57da7d0875ff67eca8a7e05617fe936e6e9
SHA256

0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e
SHA512

074d39d3acb84285dbb671a787db3edb1ef494e1504da20bd53e49b2558307c5fbcd586d18830809ba1f2c53334eaf59f7e77364ba75392ea843ad8523e2f787
SSDEEP

49152:K2wlGP/i6wRqiA97qoLGDk1VfMnHueNLrKUpYiLtF1xVzwmzt2hqiNPCyNttF:LwlCiBQJ7qceueNfwibnVpzkh9Pb5

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1700	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1700	4448	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	82
PID 4448 wrote to memory of 1700	4448	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	82
PID 4448 wrote to memory of 1700	4448	0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe	82

C:\Users\Admin\AppData\Local\Temp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe
"C:\Users\Admin\AppData\Local\Temp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\is-2B8H4.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2B8H4.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp" /SL5="$701E0,2800798,54272,C:\Users\Admin\AppData\Local\Temp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.exe"
  2⤵
  - Executes dropped EXE
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-2B8H4.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Filesize
680KB

MD5
ed69e64731547eba52476a2d2a2f7882

SHA1
cbcd56bbb5230d11a01f18e9bf59f97802bb475b

SHA256
427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0

SHA512
04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2B8H4.tmp\0fa2d9e3aa4cf4bb449da625c56a1d02a970e852fc532389d6db6fc090936a7e.tmp

Filesize
680KB

MD5
ed69e64731547eba52476a2d2a2f7882

SHA1
cbcd56bbb5230d11a01f18e9bf59f97802bb475b

SHA256
427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0

SHA512
04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe

Download Submit
memory/4448-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4448-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4448-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download