69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb

Analysis

max time kernel
267s
max time network
384s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe
Size

795KB
MD5

d6b7ad4b51cd2ee10b5b83b9448ba8a7
SHA1

46aaa0f38f1d303bf3e5a6157f5fa88901ff495f
SHA256

69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb
SHA512

f08c1f743c7cf9c8094e81060bf7a4c2e8498f5a3fe8b143352be569ca7e298301ac1f0d9fa1d210d91726ad55b48202615df2c98f892889073913f2fd7bfdd5
SSDEEP

24576:uueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+0:uuCTsdRBZbDxQqRRdfc3MncVoD+0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1920	launch.exe
1308	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Loads dropped DLL 2 IoCs

pid	Process
512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe
512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000012335-74.dat	nsis_installer_1
behavioral1/files/0x0009000000012335-74.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1308	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe
1308	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 1920	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	28
PID 512 wrote to memory of 1920	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	28
PID 512 wrote to memory of 1920	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	28
PID 512 wrote to memory of 1920	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	28
PID 512 wrote to memory of 1920	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	28
PID 512 wrote to memory of 1920	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	28
PID 512 wrote to memory of 1920	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	28
PID 512 wrote to memory of 1308	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	29
PID 512 wrote to memory of 1308	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	29
PID 512 wrote to memory of 1308	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	29
PID 512 wrote to memory of 1308	512	69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe	29

C:\Users\Admin\AppData\Local\Temp\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe
"C:\Users\Admin\AppData\Local\Temp\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:512
- C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "e69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe" "69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe
  C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe /path="C:\Users\Admin\AppData\Local\Temp\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\e69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Filesize
325KB

MD5
13ee1c03daec55875db9808cebbfff5d

SHA1
e182704191ee3277c20d73d5d47a3774d8c978a8

SHA256
134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d

SHA512
36c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\installer.exe

Filesize
795KB

MD5
d6b7ad4b51cd2ee10b5b83b9448ba8a7

SHA1
46aaa0f38f1d303bf3e5a6157f5fa88901ff495f

SHA256
69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb

SHA512
f08c1f743c7cf9c8094e81060bf7a4c2e8498f5a3fe8b143352be569ca7e298301ac1f0d9fa1d210d91726ad55b48202615df2c98f892889073913f2fd7bfdd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
\Users\Admin\AppData\Local\Temp\DM\69ede1c69d238bee7dc858f129144c433715a6682b9d5b7f55879be3acc1a8fb.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/512-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/512-55-0x0000000074861000-0x0000000074863000-memory.dmp

Filesize
8KB

Download
memory/1308-71-0x000007FEF3A90000-0x000007FEF44B3000-memory.dmp

Filesize
10.1MB

Download
memory/1308-67-0x0000000000000000-mapping.dmp

Download
memory/1308-72-0x000007FEF2310000-0x000007FEF33A6000-memory.dmp

Filesize
16.6MB

Download
memory/1308-73-0x0000000000C26000-0x0000000000C45000-memory.dmp

Filesize
124KB

Download
memory/1920-57-0x0000000000000000-mapping.dmp

Download
memory/1920-65-0x0000000074070000-0x000000007461B000-memory.dmp

Filesize
5.7MB

Download
memory/1920-62-0x0000000074070000-0x000000007461B000-memory.dmp

Filesize
5.7MB

Download
memory/1920-64-0x0000000074070000-0x000000007461B000-memory.dmp

Filesize
5.7MB

Download