f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8

Analysis

max time kernel
130s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe
Size

690KB
MD5

90f2586ef8fbec1ea0475472d90e15ca
SHA1

c5ed98a301d2ea9ee643fdcb4fe14e5ee9895ef0
SHA256

f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8
SHA512

79f4be94c8c4cc94c20f58f42496ee853d3eca2767fdc015472ddcd8dc105b608dae18a76f9087e63bad04eaa2d85820add1a6581397b1fcab0dcd63be1409e2
SSDEEP

12288:DuudKYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfSlz3nMoRKe3s7Bm3JSMz6:DueKYT/hmflRBmqPeQ93D4AQalz3M+5U

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
848	launch.exe
544	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Loads dropped DLL 2 IoCs

pid	Process
1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe
1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00080000000122fc-73.dat	nsis_installer_1
behavioral1/files/0x00080000000122fc-73.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
544	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe
544	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 848	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	28
PID 1916 wrote to memory of 848	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	28
PID 1916 wrote to memory of 848	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	28
PID 1916 wrote to memory of 848	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	28
PID 1916 wrote to memory of 848	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	28
PID 1916 wrote to memory of 848	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	28
PID 1916 wrote to memory of 848	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	28
PID 1916 wrote to memory of 544	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	29
PID 1916 wrote to memory of 544	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	29
PID 1916 wrote to memory of 544	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	29
PID 1916 wrote to memory of 544	1916	f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe	29

C:\Users\Admin\AppData\Local\Temp\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe
"C:\Users\Admin\AppData\Local\Temp\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\launch.exe "ef397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe" "f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe" "481d54c9c60e417eb38d368e4706b47c" dec
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe
  C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe /path="C:\Users\Admin\AppData\Local\Temp\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\ef397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Filesize
223KB

MD5
606ba1daabb6c2fcd4f4302f38d63bc8

SHA1
94172c1a104bc912b53be8a2f6fd0f575ad1bb45

SHA256
e69957870adfae19916573d0224aa8b39c8df3945d82dd42a6c590be68cd47d5

SHA512
18f19c3c9c59caba7554a4cbc5923239f39b37081798b9706dec439936a423393401d883c471ba0de1706c6d7493d00db5cff9ef66e4eb44c067f85369eb2b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Filesize
223KB

MD5
40b0ff02c8d35a10e9aa996f53ed159d

SHA1
a5947306d9a0859d01cbff1a4c6b39ed348f39e9

SHA256
1ce87bde227639bfe9ee3c61de2cb6523318f2e51d5c686170adbf0e5e610a11

SHA512
da239235d5c9af2202dcc8bb43ea647ef026c3738031bd84a391b465fec9f72c2fa23bfcbb6ef31d7b9fdc2de97ae6a4a66b5d00867ead3a1d7c34a9ab583568

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Filesize
223KB

MD5
40b0ff02c8d35a10e9aa996f53ed159d

SHA1
a5947306d9a0859d01cbff1a4c6b39ed348f39e9

SHA256
1ce87bde227639bfe9ee3c61de2cb6523318f2e51d5c686170adbf0e5e610a11

SHA512
da239235d5c9af2202dcc8bb43ea647ef026c3738031bd84a391b465fec9f72c2fa23bfcbb6ef31d7b9fdc2de97ae6a4a66b5d00867ead3a1d7c34a9ab583568

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\installer.exe

Filesize
690KB

MD5
90f2586ef8fbec1ea0475472d90e15ca

SHA1
c5ed98a301d2ea9ee643fdcb4fe14e5ee9895ef0

SHA256
f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8

SHA512
79f4be94c8c4cc94c20f58f42496ee853d3eca2767fdc015472ddcd8dc105b608dae18a76f9087e63bad04eaa2d85820add1a6581397b1fcab0dcd63be1409e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe

Filesize
223KB

MD5
40b0ff02c8d35a10e9aa996f53ed159d

SHA1
a5947306d9a0859d01cbff1a4c6b39ed348f39e9

SHA256
1ce87bde227639bfe9ee3c61de2cb6523318f2e51d5c686170adbf0e5e610a11

SHA512
da239235d5c9af2202dcc8bb43ea647ef026c3738031bd84a391b465fec9f72c2fa23bfcbb6ef31d7b9fdc2de97ae6a4a66b5d00867ead3a1d7c34a9ab583568

Download Submit
\Users\Admin\AppData\Local\Temp\DM\f397b1e429463ea1fcfbb87d2f8b19b0ab5a4c1535789337765bba21a924fce8.exe\33fda81260d1464e9d5de4d7190be23d\launch.exe

Filesize
21KB

MD5
ae93c3a8315679a5fb24db3fe04e750c

SHA1
31a5a7a50040fea708aef69df0429ecf3d6054bd

SHA256
3207d2a3e4c1488c98c08e2273e2758b6b1b11179da0a99293a04179de2d1398

SHA512
01120249b1e8fb385220e815b98c8e8f4b0d9e95c86dd2b5ab42a5ee875fa6f26228bff623b5a9e4ae3bf0c7ef46d726beb190c4b9cc3557968efb79da8201bd

Download Submit
memory/544-70-0x000007FEF41E0000-0x000007FEF4C03000-memory.dmp

Filesize
10.1MB

Download
memory/544-71-0x000007FEF2F00000-0x000007FEF3F96000-memory.dmp

Filesize
16.6MB

Download
memory/544-72-0x0000000000B06000-0x0000000000B25000-memory.dmp

Filesize
124KB

Download
memory/848-62-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/848-64-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/1916-55-0x0000000074721000-0x0000000074723000-memory.dmp

Filesize
8KB

Download
memory/1916-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download