90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868

Analysis

max time kernel
153s
max time network
194s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
Size

50KB
MD5

4ee969b86eeb04606cb873b9a3f3fcd7
SHA1

ba9abd2e08488570e099657d120ae727138b48d3
SHA256

90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868
SHA512

f305e52c702a0ff426bb76278d10b4ae8807b7a61f75c34f809d2c64b2f2c74a682d8cdc705dd22a068bdb99f9ba74c18d33bb00ba0f4f607f90026b3fa146ad
SSDEEP

768:LhYqqVXMwcDcQzGmaigvM0OV3kuixIpHG0D3hjXO3XJBMk/fqpkfPNHQ3U1fRu7:VSV8/DcCDCMMkG0DaXJBMk/ypsdQSA7

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MID	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MID\PIC = "811202212051857162768615"	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1472	564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe	28
PID 564 wrote to memory of 1472	564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe	28
PID 564 wrote to memory of 1472	564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe	28
PID 564 wrote to memory of 1472	564	90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe	28

C:\Users\Admin\AppData\Local\Temp\90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
"C:\Users\Admin\AppData\Local\Temp\90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe
  "C:\Users\Admin\AppData\Local\Temp\90540852549eb1eeb21aafcce32ae617efa25fb017dd08e091fd3352e08b1868.exe"
  2⤵
  PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WiderEvents\flag.txt

Filesize
14B

MD5
aaa67a3ea926d0564ac036927e0e6677

SHA1
818cab037ece2ce795a635c601730f6195f759a5

SHA256
30d7762cce017f325d02154744caa51f06215ac9c60ec404012581187153cdc4

SHA512
60aec557eba1c2e89db5772056878b254135d3d027096574e72e57e74d3a33f5b4e18a2a2033628b2b57d5c3d7fb93773da24ad87ef34decfa5c1b63812e399b

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA21C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/564-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download