Analysis
-
max time kernel
129s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 22:49
Static task
static1
Behavioral task
behavioral1
Sample
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe
Resource
win10v2004-20220812-en
General
-
Target
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe
-
Size
183KB
-
MD5
8a73a6b93c588d4589d8aeae4fb4fd20
-
SHA1
622fc0e75a1b560a3252508f47e452ba4df2c4f7
-
SHA256
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f
-
SHA512
e1257bcd5ce7c09ab7717c19f1127e473503cc3c2812a9ff9cf15f988fe275c18cfdf5bcdbf403a620a1da9b8529b8932701d64694eb01cd3a52e9a47fb23bcf
-
SSDEEP
3072:FfqtXFHwoFe2v9zIN45CbeZ9ZK1UYDtMpdMU5nKKlkkDZY0mdfbi4CWE/wW226F4:FfgFQoFekiVe3KjDtQdHKKa0pw7F4
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exepid process 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exedescription pid process target process PID 1728 set thread context of 1904 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exepid process 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exedescription pid process target process PID 1728 wrote to memory of 1904 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe PID 1728 wrote to memory of 1904 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe PID 1728 wrote to memory of 1904 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe PID 1728 wrote to memory of 1904 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe PID 1728 wrote to memory of 1904 1728 ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe"C:\Users\Admin\AppData\Local\Temp\ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe"C:\Users\Admin\AppData\Local\Temp\ae09565a3928e43cf0df871ff58f59f601e715a4b57552ce45c30da08809828f.exe"2⤵PID:1904
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nso6F3A.tmp\System.dllFilesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
memory/1728-54-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1728-56-0x0000000000450000-0x000000000046D000-memory.dmpFilesize
116KB
-
memory/1728-57-0x0000000000450000-0x000000000046D000-memory.dmpFilesize
116KB
-
memory/1904-58-0x00000000001C56BA-mapping.dmp
-
memory/1904-60-0x00000000001C0000-0x00000000001E7000-memory.dmpFilesize
156KB
-
memory/1904-61-0x0000000000450000-0x0000000000477000-memory.dmpFilesize
156KB
-
memory/1904-62-0x0000000000450000-0x0000000000477000-memory.dmpFilesize
156KB