66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df

Analysis

max time kernel
203s
max time network
222s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe
Size

795KB
MD5

eb12fb5c98205bf2e8963be694b70f46
SHA1

ed533bb36a127cd18d7ece2cad69eabf8912bd55
SHA256

66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df
SHA512

76e248f0cc2e44962e60d541ffbad090a9a2c30ad09226177b2d32b2edcf437f1906dfd4a74e84209e7c66ec71f658c4b36b659104fd5942bf1f828b962609ff
SSDEEP

24576:hueAYT/hmflRBmqPeQ93D4AQqRRdfcj4wMn0DVooC+Z:huCTsdRBZbDxQqRRdfc3MncVoD+Z

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1312	launch.exe
108	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Loads dropped DLL 2 IoCs

pid	Process
1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe
1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00070000000133d3-73.dat	nsis_installer_1
behavioral1/files/0x00070000000133d3-73.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
108	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe
108	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1312	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	27
PID 1728 wrote to memory of 1312	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	27
PID 1728 wrote to memory of 1312	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	27
PID 1728 wrote to memory of 1312	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	27
PID 1728 wrote to memory of 1312	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	27
PID 1728 wrote to memory of 1312	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	27
PID 1728 wrote to memory of 1312	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	27
PID 1728 wrote to memory of 108	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	28
PID 1728 wrote to memory of 108	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	28
PID 1728 wrote to memory of 108	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	28
PID 1728 wrote to memory of 108	1728	66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe	28

C:\Users\Admin\AppData\Local\Temp\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe
"C:\Users\Admin\AppData\Local\Temp\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe "e66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe" "66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe" "3b58bf0f691b4f20b2d34b2b6f203603" dec
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe
  C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe /path="C:\Users\Admin\AppData\Local\Temp\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\e66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Filesize
325KB

MD5
13ee1c03daec55875db9808cebbfff5d

SHA1
e182704191ee3277c20d73d5d47a3774d8c978a8

SHA256
134887182a71915571ba2b5d8a9767f7008bd2282c7a123eab9816ade8290d0d

SHA512
36c40cd26a4106c173851095234515c99d49882993f74c2249436bf21b1a7a922d6a2284e6b063f4857ec24678d12e22fc2b40e642e60ffb266a32fd577b22c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\installer.exe

Filesize
795KB

MD5
eb12fb5c98205bf2e8963be694b70f46

SHA1
ed533bb36a127cd18d7ece2cad69eabf8912bd55

SHA256
66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df

SHA512
76e248f0cc2e44962e60d541ffbad090a9a2c30ad09226177b2d32b2edcf437f1906dfd4a74e84209e7c66ec71f658c4b36b659104fd5942bf1f828b962609ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe

Filesize
325KB

MD5
68c21b1d783650d0f2b55f351f441283

SHA1
008873cbe3713a1f50fa82e96da0fd742192e73b

SHA256
5e132398bec07c854aa445efed2348fa80e9cd7d537589f1068a1ba6d4e8ac15

SHA512
2152d874edad56ed0c575c0fe2b1fb4d0e2d0d1f3f1fff6979fdff62030830a01757fb52a4e8ba6400b291c1f3b3790cf74224c87c317356c5050619b88e3b86

Download Submit
\Users\Admin\AppData\Local\Temp\DM\66fcb691c582386a426c907c17d3687c236a3ac3734477510162a58e437394df.exe\a896107152fe41c096cc6b72a98f0d89\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/108-66-0x0000000000000000-mapping.dmp

Download
memory/108-70-0x000007FEF4A40000-0x000007FEF5463000-memory.dmp

Filesize
10.1MB

Download
memory/108-71-0x000007FEF3760000-0x000007FEF47F6000-memory.dmp

Filesize
16.6MB

Download
memory/108-72-0x0000000000AA6000-0x0000000000AC5000-memory.dmp

Filesize
124KB

Download
memory/1312-64-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/1312-57-0x0000000000000000-mapping.dmp

Download
memory/1312-62-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/1728-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1728-55-0x0000000074F81000-0x0000000074F83000-memory.dmp

Filesize
8KB

Download