a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe
Size

795KB
MD5

5180b402dcdf1bdde4d1a502a54c10ec
SHA1

25f4fc8ce8c9607ecd4abca8820e47efe57fcaf6
SHA256

a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108
SHA512

bbfe7807c54b6493f548256c08f8438ab54285a901addf0588b75e2ef44fcb793ee70923d225460a3c238244f3d01abd4ad9aee44b02113cb3845a050c24b898
SSDEEP

24576:pueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+g:puCTsdRBZbDxQqRRdfc3MncVoD+g

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1072	launch.exe
912	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Loads dropped DLL 2 IoCs

pid	Process
1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe
1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00090000000122f1-73.dat	nsis_installer_1
behavioral1/files/0x00090000000122f1-73.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
912	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe
912	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1072	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	27
PID 1872 wrote to memory of 1072	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	27
PID 1872 wrote to memory of 1072	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	27
PID 1872 wrote to memory of 1072	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	27
PID 1872 wrote to memory of 1072	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	27
PID 1872 wrote to memory of 1072	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	27
PID 1872 wrote to memory of 1072	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	27
PID 1872 wrote to memory of 912	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	28
PID 1872 wrote to memory of 912	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	28
PID 1872 wrote to memory of 912	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	28
PID 1872 wrote to memory of 912	1872	a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe	28

C:\Users\Admin\AppData\Local\Temp\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe
"C:\Users\Admin\AppData\Local\Temp\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "ea92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe" "a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe
  C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe /path="C:\Users\Admin\AppData\Local\Temp\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\ea92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Filesize
325KB

MD5
13ee1c03daec55875db9808cebbfff5d

SHA1
e182704191ee3277c20d73d5d47a3774d8c978a8

SHA256
134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d

SHA512
36c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\installer.exe

Filesize
795KB

MD5
5180b402dcdf1bdde4d1a502a54c10ec

SHA1
25f4fc8ce8c9607ecd4abca8820e47efe57fcaf6

SHA256
a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108

SHA512
bbfe7807c54b6493f548256c08f8438ab54285a901addf0588b75e2ef44fcb793ee70923d225460a3c238244f3d01abd4ad9aee44b02113cb3845a050c24b898

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
\Users\Admin\AppData\Local\Temp\DM\a92fa0817172c9effeb84f18cf7f3c44afe793587581d4b899fe875c12df3108.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/912-70-0x000007FEF3E20000-0x000007FEF4843000-memory.dmp

Filesize
10.1MB

Download
memory/912-71-0x000007FEF2030000-0x000007FEF30C6000-memory.dmp

Filesize
16.6MB

Download
memory/912-72-0x0000000000AC6000-0x0000000000AE5000-memory.dmp

Filesize
124KB

Download
memory/1072-64-0x0000000073B70000-0x000000007411B000-memory.dmp

Filesize
5.7MB

Download
memory/1072-62-0x0000000073B70000-0x000000007411B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1872-55-0x0000000074241000-0x0000000074243000-memory.dmp

Filesize
8KB

Download