a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
Size

1.4MB
MD5

8b37439aba301bff82dcaa498fe3ed49
SHA1

c2c708ff671d881ab31aa35a6d6fb3aa70ef2d68
SHA256

a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d
SHA512

5fafb3996066027c075b127ab565c5f2828be80cf13493c71c3ceb2c90cda21e0a2d89cddfedc81fb3ccd77b63aea595333610b6091baabc4b23022b6e344267
SSDEEP

24576:dUWq9EC4sDG3i08cL7VKQwZMT/h7g2smZ0ItcIxtzbHOoB4XsB95B/GiYPOn4Hy2:rAmi08yptsM17g2nxtcIx9HOoBh95BDZ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1672-63-0x0000000000400000-0x00000000008BD000-memory.dmp	upx
behavioral1/memory/1672-67-0x0000000000400000-0x00000000008BD000-memory.dmp	upx

Loads dropped DLL 10 IoCs

pid	Process
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SkinH_EL.dll	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
File created	C:\Windows\SysWOW64\DNFÊäÈë·¨.ime	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\otup.dll	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
1672	a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe

C:\Users\Admin\AppData\Local\Temp\a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe
"C:\Users\Admin\AppData\Local\Temp\a9200cd6c58de4f5d20d10d387cf4912daab1037179ddfdda887b9004dad9c5d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
c19a9f52996c85527e500747a7d69749

SHA1
ad867382e1f3696f1a46a577c62e49cbd3b03a14

SHA256
1c335c6d63bdf8fc0382bca35a0da10b2b0d4f338f85e18189beab13c45a942b

SHA512
e54323b141d813499b9e763de8df06870fa6a225d1403bd1bec49dc4a0996d11f53706bb6fe58a11f5dc639999a51a8f99d4241b54a1edaf75ba43a30dd78f12

Download Submit
\Windows\SysWOW64\SkinH_EL.dll

Filesize
688KB

MD5
bd42ef63fc0f79fdaaeca95d62a96bbb

SHA1
97ca8ccb0e6f7ffeb05dc441b2427feb0b634033

SHA256
573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48

SHA512
431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c

Download Submit
memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1672-63-0x0000000000400000-0x00000000008BD000-memory.dmp

Filesize
4.7MB

Download
memory/1672-66-0x0000000003650000-0x00000000036FF000-memory.dmp

Filesize
700KB

Download
memory/1672-67-0x0000000000400000-0x00000000008BD000-memory.dmp

Filesize
4.7MB

Download