Analysis
-
max time kernel
152s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe
Resource
win10v2004-20221111-en
General
-
Target
04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe
-
Size
535KB
-
MD5
95258c27969241e96940549366fac583
-
SHA1
1ca1900a0df3c9171a731172e3599174c455a218
-
SHA256
04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b
-
SHA512
5397ee811264d20565269a959d896abb03347e07a28262eabfc0bf5d33b2748ae6e1a51d72df61cdf5e151fa18f52c3baae35b5a9263456aaf72b7cd9c07656d
-
SSDEEP
12288:iuoTnfwVQ8076pKJ1P70nsqDGZj8+JYtUKauqpoPV5:ijTnfwVQz+KXB18+Jo7rqCr
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2736 Launcher.exe 2300 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe -
Loads dropped DLL 2 IoCs
pid Process 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0007000000022e19-147.dat nsis_installer_1 behavioral2/files/0x0007000000022e19-147.dat nsis_installer_2 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2300 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe 2300 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2736 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe 86 PID 1652 wrote to memory of 2736 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe 86 PID 1652 wrote to memory of 2736 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe 86 PID 1652 wrote to memory of 2300 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe 89 PID 1652 wrote to memory of 2300 1652 04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe"C:\Users\Admin\AppData\Local\Temp\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\Launcher.exeC:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\Launcher.exe /in="e04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe" /out="04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe" /psw="2f65ecbb08894781abe96e27e619bac4" /typ=dec2⤵
- Executes dropped EXE
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exeC:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe /path="C:\Users\Admin\AppData\Local\Temp\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe
Filesize388KB
MD511b844b7f36d50745876cf89d599c9d2
SHA16158f8d556f1c1580f849d113f63794bc5556270
SHA256ea57491bbb6dbeaf1e8dd600560d738012bb660cc2823262e36172847d084d9b
SHA512135726173ddd1f89c8d7134f797b9dabc4a18f34598c305ec71eeb45285d5870a3d835dc049ffab72233c77454e47b8c5645971f15775b78b995be137f5760d3
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe
Filesize388KB
MD511b844b7f36d50745876cf89d599c9d2
SHA16158f8d556f1c1580f849d113f63794bc5556270
SHA256ea57491bbb6dbeaf1e8dd600560d738012bb660cc2823262e36172847d084d9b
SHA512135726173ddd1f89c8d7134f797b9dabc4a18f34598c305ec71eeb45285d5870a3d835dc049ffab72233c77454e47b8c5645971f15775b78b995be137f5760d3
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe.config
Filesize690B
MD5bca0ea75b6940aa86960d7b9098a5998
SHA13d57f82158ac72c7eb2e72ba19a80485d8103130
SHA2565a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d
SHA512260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\Launcher.exe
Filesize104KB
MD584f73e5ebbc81f574eead8f346e32572
SHA1d0db9da5ebaf67f58565ad09f2aa2d05aab4733b
SHA256fe71f2d3bca15130f9fa29adacd988471103c62050c71b8fe00023f36e317c4c
SHA512d790908d056a4eed569393cd41d7bf9f4300846f10f107fc070dc2e275cd99d4df752c1891393ef5614caf103dd58202bfcfc1eb1fdd088f9da6cd52b38aa857
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\Launcher.exe
Filesize104KB
MD584f73e5ebbc81f574eead8f346e32572
SHA1d0db9da5ebaf67f58565ad09f2aa2d05aab4733b
SHA256fe71f2d3bca15130f9fa29adacd988471103c62050c71b8fe00023f36e317c4c
SHA512d790908d056a4eed569393cd41d7bf9f4300846f10f107fc070dc2e275cd99d4df752c1891393ef5614caf103dd58202bfcfc1eb1fdd088f9da6cd52b38aa857
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\Launcher.exe.config
Filesize340B
MD591629f6b28cbe2b52bb86cb5af3bdbca
SHA135fb57ac58c9eb0668f5832a588d9f81e040568b
SHA256589c122996fadc118731c6f983c5d3b498c4b4b59700ea548f4cfb79e4eaaeeb
SHA512f08382296696173784841a163c73c19e7bd674a08a053c0434d55696f45039721925e5d829e4bbbf71b07385d1b88c5ea241b8247eb0d81bf381205977bd14c5
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\e04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe
Filesize388KB
MD5fbc1d86afd9be2839aa82b3762fde807
SHA1da9755e0581b5265a3761c9b09c303616a18b87b
SHA2560fb8f9dd0dc7c053719b479c3920339fb06203d175ff14e8645357104bf0d53f
SHA51244b5258a10276b785009fcc60e176d7b4ae1c6410464e8511d321babedbf20d154dc28ad8c5506d2d241f5a3227ea650467cf25ec3a6a1313d1e801b1eed9457
-
C:\Users\Admin\AppData\Local\Temp\DM\04a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b.exe\1bwZ6m4URCMyxxQ\installer.exe
Filesize535KB
MD595258c27969241e96940549366fac583
SHA11ca1900a0df3c9171a731172e3599174c455a218
SHA25604a5996ac718b5632deeb7df0eef9f67b12e7e94ea5899da7e1c78a9975a776b
SHA5125397ee811264d20565269a959d896abb03347e07a28262eabfc0bf5d33b2748ae6e1a51d72df61cdf5e151fa18f52c3baae35b5a9263456aaf72b7cd9c07656d
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
16KB
MD5a555472395178ac8c733d90928e05017
SHA1f44b192d66473f01a6540aaec4b6c9ac4c611d35
SHA25682ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e
SHA512e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a