880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102

General

Target

880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe
Size

48KB
MD5

429c53b9255f0768c6b2ffa72ca9b309
SHA1

82bc33fd42b70587f6c869345f9634929e38829c
SHA256

880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102
SHA512

62b9d62b4ca724df269cc88f19789888c90f2b567bbbb8319d23941ccaba89dec01ac6558f996831203a7a908500f68d4b18a6f836acfa701a2af3b7444eb85b
SSDEEP

768:SoOjbhlc7sUoQnAz3ppOo0QJSHijv5js/wJJQPgd2iZQAm6kRRS+NoJRnOet:XOPhlosUoAarDX1JJQgdLeAyNZO

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1992	Au_.exe

Loads dropped DLL 4 IoCs

pid	Process
2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe
1992	Au_.exe
1992	Au_.exe
1992	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 12 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000012314-55.dat	nsis_installer_1
behavioral1/files/0x0009000000012314-55.dat	nsis_installer_2
behavioral1/files/0x0009000000012314-57.dat	nsis_installer_1
behavioral1/files/0x0009000000012314-57.dat	nsis_installer_2
behavioral1/files/0x0009000000012314-60.dat	nsis_installer_1
behavioral1/files/0x0009000000012314-60.dat	nsis_installer_2
behavioral1/files/0x0009000000012314-59.dat	nsis_installer_1
behavioral1/files/0x0009000000012314-59.dat	nsis_installer_2
behavioral1/files/0x0009000000012314-61.dat	nsis_installer_1
behavioral1/files/0x0009000000012314-61.dat	nsis_installer_2
behavioral1/files/0x0009000000012314-62.dat	nsis_installer_1
behavioral1/files/0x0009000000012314-62.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1992	2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe	28
PID 2044 wrote to memory of 1992	2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe	28
PID 2044 wrote to memory of 1992	2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe	28
PID 2044 wrote to memory of 1992	2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe	28
PID 2044 wrote to memory of 1992	2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe	28
PID 2044 wrote to memory of 1992	2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe	28
PID 2044 wrote to memory of 1992	2044	880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe	28

C:\Users\Admin\AppData\Local\Temp\880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe
"C:\Users\Admin\AppData\Local\Temp\880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
48KB

MD5
429c53b9255f0768c6b2ffa72ca9b309

SHA1
82bc33fd42b70587f6c869345f9634929e38829c

SHA256
880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102

SHA512
62b9d62b4ca724df269cc88f19789888c90f2b567bbbb8319d23941ccaba89dec01ac6558f996831203a7a908500f68d4b18a6f836acfa701a2af3b7444eb85b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
48KB

MD5
429c53b9255f0768c6b2ffa72ca9b309

SHA1
82bc33fd42b70587f6c869345f9634929e38829c

SHA256
880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102

SHA512
62b9d62b4ca724df269cc88f19789888c90f2b567bbbb8319d23941ccaba89dec01ac6558f996831203a7a908500f68d4b18a6f836acfa701a2af3b7444eb85b

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
48KB

MD5
429c53b9255f0768c6b2ffa72ca9b309

SHA1
82bc33fd42b70587f6c869345f9634929e38829c

SHA256
880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102

SHA512
62b9d62b4ca724df269cc88f19789888c90f2b567bbbb8319d23941ccaba89dec01ac6558f996831203a7a908500f68d4b18a6f836acfa701a2af3b7444eb85b

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
48KB

MD5
429c53b9255f0768c6b2ffa72ca9b309

SHA1
82bc33fd42b70587f6c869345f9634929e38829c

SHA256
880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102

SHA512
62b9d62b4ca724df269cc88f19789888c90f2b567bbbb8319d23941ccaba89dec01ac6558f996831203a7a908500f68d4b18a6f836acfa701a2af3b7444eb85b

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
48KB

MD5
429c53b9255f0768c6b2ffa72ca9b309

SHA1
82bc33fd42b70587f6c869345f9634929e38829c

SHA256
880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102

SHA512
62b9d62b4ca724df269cc88f19789888c90f2b567bbbb8319d23941ccaba89dec01ac6558f996831203a7a908500f68d4b18a6f836acfa701a2af3b7444eb85b

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
48KB

MD5
429c53b9255f0768c6b2ffa72ca9b309

SHA1
82bc33fd42b70587f6c869345f9634929e38829c

SHA256
880f2f20d2061bb695efc9aec8f7d1af70ef2fdb5cf55c002c68e58569370102

SHA512
62b9d62b4ca724df269cc88f19789888c90f2b567bbbb8319d23941ccaba89dec01ac6558f996831203a7a908500f68d4b18a6f836acfa701a2af3b7444eb85b

Download Submit
memory/2044-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing