4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe
Size

794KB
MD5

50d6cd928a514a343a14e78bed67e4b3
SHA1

f7049c715ce1c1998b04333e233562a0486b623e
SHA256

4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5
SHA512

9cae98e173ba0800c123a6827067ad8a160f2c03d696303b0174d8795865bdcc923258720ec4fcc0030f8112b81d74ea87ca0f88a88a9a033adcb3f15987865d
SSDEEP

24576:huefYT/hmflRBmqPeQ93D4AQASnE9VnX/vcGT:huFTsdRBZbDxQASnET/vcGT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1132	launch.exe
724	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Loads dropped DLL 2 IoCs

pid	Process
1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe
1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00080000000122dd-73.dat	nsis_installer_1
behavioral1/files/0x00080000000122dd-73.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
724	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe
724	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1132	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	28
PID 1632 wrote to memory of 1132	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	28
PID 1632 wrote to memory of 1132	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	28
PID 1632 wrote to memory of 1132	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	28
PID 1632 wrote to memory of 1132	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	28
PID 1632 wrote to memory of 1132	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	28
PID 1632 wrote to memory of 1132	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	28
PID 1632 wrote to memory of 724	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	29
PID 1632 wrote to memory of 724	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	29
PID 1632 wrote to memory of 724	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	29
PID 1632 wrote to memory of 724	1632	4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe	29

C:\Users\Admin\AppData\Local\Temp\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe
"C:\Users\Admin\AppData\Local\Temp\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\launch.exe "e4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe" "4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe" "936d475e3aaa4dcca54a487a8bcce5c6" dec
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe
  C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe /path="C:\Users\Admin\AppData\Local\Temp\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\e4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Filesize
325KB

MD5
5878afd32f2c56a933f2dfba27e2844f

SHA1
341bd1d2e6ab5bb0b09fae17d36af8532102e726

SHA256
f5fff848e6e6cd04da3782e94a352ad2256c30c79da25752ead38ade4fb801a6

SHA512
eda462b07e112ef4d9e80cf68e489796f0f4371f3c164e826a538026c518c26fe0466284ff68e57b3d99682e91745efd5f2e2d35ece3ebdc89cec71e745b1d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\installer.exe

Filesize
794KB

MD5
50d6cd928a514a343a14e78bed67e4b3

SHA1
f7049c715ce1c1998b04333e233562a0486b623e

SHA256
4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5

SHA512
9cae98e173ba0800c123a6827067ad8a160f2c03d696303b0174d8795865bdcc923258720ec4fcc0030f8112b81d74ea87ca0f88a88a9a033adcb3f15987865d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe

Filesize
325KB

MD5
14d3f16b4fca420cd717c994d5fd5f64

SHA1
c9bb8224e6c4a6ff349b3be2214ecd171c51a35e

SHA256
8757bcb8b6400912f2d1c9eb39ac18db887f8493ff8ff69b02dad14261731231

SHA512
9028c7947fc0aed00f7ee9f04f109b1c6ea99aba0acf848b3fad96ee40b892bcd800d489ed42a19d60b20e3f2fb381c8e33e953f44d81cd0ed0f328c07e6c009

Download Submit
\Users\Admin\AppData\Local\Temp\DM\4e3cd5de2b49e6977fecd1830763c4a9b9668753bd2adb3bdca582ad6e28cbb5.exe\edb808b20e17488db0caef3203e64515\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/724-70-0x000007FEF4280000-0x000007FEF4CA3000-memory.dmp

Filesize
10.1MB

Download
memory/724-71-0x000007FEEEC10000-0x000007FEEFCA6000-memory.dmp

Filesize
16.6MB

Download
memory/724-72-0x0000000002156000-0x0000000002175000-memory.dmp

Filesize
124KB

Download
memory/1132-64-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1132-62-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1632-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download