a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe
Size

421KB
MD5

3c973afff6acbb49be83d0db70293ed6
SHA1

3407ba702243310e5601e5174e9696f5a970cd5a
SHA256

a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9
SHA512

8a406fa57509e229d93684eb83a1d471e0d159ff16a80084c9dfd1bf2fd3d2dcd8dae91b3b8a29dd0205c596dc62e7fb1d3477fb34adb7de5b2086c981705c76
SSDEEP

12288:DjODTivE9GzlZ3yPRpb+Wvo3/nZFozAKR4pI:DjOysIhZ3ORpbBofZFv7pI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
852	AutoInst.exe

Loads dropped DLL 4 IoCs

pid	Process
2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe
2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe
2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe
2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 852	2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	26
PID 2000 wrote to memory of 852	2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	26
PID 2000 wrote to memory of 852	2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	26
PID 2000 wrote to memory of 852	2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	26
PID 2000 wrote to memory of 852	2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	26
PID 2000 wrote to memory of 852	2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	26
PID 2000 wrote to memory of 852	2000	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	26

C:\Users\Admin\AppData\Local\Temp\a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe
"C:\Users\Admin\AppData\Local\Temp\a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.exe"
  2⤵
  - Executes dropped EXE
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.exe

Filesize
805KB

MD5
6709897005120aec5674859cc20b1db3

SHA1
d6060f0989d6aea4b51f7dde439ca5a21fbc6639

SHA256
ebddf94172297bcf26fb6142f599de1facb43ab81e8fdf0d83fa79ad2f7ff5c8

SHA512
a753ff5121b2c64d473542bee51a90bb953e65879c9cd44812b4b0fd921aa7e19012341b05ccf6fd58c05c3f34715b671c6924526c165ba2aaf3804eb0b421b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.ini

Filesize
161B

MD5
c541b88384d2691445a1eadb3d5cb741

SHA1
68e0b2dcea6718051637558982ed6479bf6f2fae

SHA256
4aa9d9874a06746af6c3cc97109bf5b9e52be081ec2b75c662c1aabaedc109a7

SHA512
aec6960a8e981acd4e84edf634efbf0b3fc3cfd4e0f05d94756447df2061db27f740d17c64e04a126232a228bee0a1b840c048f2d03200afd858bb31ee083f2a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.exe

Filesize
805KB

MD5
6709897005120aec5674859cc20b1db3

SHA1
d6060f0989d6aea4b51f7dde439ca5a21fbc6639

SHA256
ebddf94172297bcf26fb6142f599de1facb43ab81e8fdf0d83fa79ad2f7ff5c8

SHA512
a753ff5121b2c64d473542bee51a90bb953e65879c9cd44812b4b0fd921aa7e19012341b05ccf6fd58c05c3f34715b671c6924526c165ba2aaf3804eb0b421b5

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.exe

Filesize
805KB

MD5
6709897005120aec5674859cc20b1db3

SHA1
d6060f0989d6aea4b51f7dde439ca5a21fbc6639

SHA256
ebddf94172297bcf26fb6142f599de1facb43ab81e8fdf0d83fa79ad2f7ff5c8

SHA512
a753ff5121b2c64d473542bee51a90bb953e65879c9cd44812b4b0fd921aa7e19012341b05ccf6fd58c05c3f34715b671c6924526c165ba2aaf3804eb0b421b5

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.exe

Filesize
805KB

MD5
6709897005120aec5674859cc20b1db3

SHA1
d6060f0989d6aea4b51f7dde439ca5a21fbc6639

SHA256
ebddf94172297bcf26fb6142f599de1facb43ab81e8fdf0d83fa79ad2f7ff5c8

SHA512
a753ff5121b2c64d473542bee51a90bb953e65879c9cd44812b4b0fd921aa7e19012341b05ccf6fd58c05c3f34715b671c6924526c165ba2aaf3804eb0b421b5

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5957.tmp\AutoInst.exe

Filesize
805KB

MD5
6709897005120aec5674859cc20b1db3

SHA1
d6060f0989d6aea4b51f7dde439ca5a21fbc6639

SHA256
ebddf94172297bcf26fb6142f599de1facb43ab81e8fdf0d83fa79ad2f7ff5c8

SHA512
a753ff5121b2c64d473542bee51a90bb953e65879c9cd44812b4b0fd921aa7e19012341b05ccf6fd58c05c3f34715b671c6924526c165ba2aaf3804eb0b421b5

Download Submit
memory/2000-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download