1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8

Analysis

max time kernel
80s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
17/12/2022, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8.exe
Size

1.6MB
MD5

0f8873030b64451e8c878fbcafaf1580
SHA1

8151ffcad953b05e40df66a66218ce484c3db6cd
SHA256

1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8
SHA512

80b88631342ab99cd4f2d3a9ce74e6361a2fe64ac9c51a1fb9dcf8f2e27a51a2444867bd5ce539bcaa77d213776808b006af64533731d8121b7b538a4fdc041e
SSDEEP

24576:hZ7Xar2VsBq/Oeb2wyxUAWACFD4b/TnI0Rm1PCtsiaZmPTOOGMIc9nJiVwyODweb:NszaAWA6MrR7EZQyLc9noV/ODweMMd

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1984	rundll32.exe
1984	rundll32.exe
1984	rundll32.exe
1984	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 976	1368	1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8.exe	27
PID 1368 wrote to memory of 976	1368	1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8.exe	27
PID 1368 wrote to memory of 976	1368	1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8.exe	27
PID 1368 wrote to memory of 976	1368	1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8.exe	27
PID 976 wrote to memory of 1984	976	control.exe	28
PID 976 wrote to memory of 1984	976	control.exe	28
PID 976 wrote to memory of 1984	976	control.exe	28
PID 976 wrote to memory of 1984	976	control.exe	28
PID 976 wrote to memory of 1984	976	control.exe	28
PID 976 wrote to memory of 1984	976	control.exe	28
PID 976 wrote to memory of 1984	976	control.exe	28
PID 1984 wrote to memory of 1120	1984	rundll32.exe	29
PID 1984 wrote to memory of 1120	1984	rundll32.exe	29
PID 1984 wrote to memory of 1120	1984	rundll32.exe	29
PID 1984 wrote to memory of 1120	1984	rundll32.exe	29
PID 1120 wrote to memory of 1664	1120	RunDll32.exe	30
PID 1120 wrote to memory of 1664	1120	RunDll32.exe	30
PID 1120 wrote to memory of 1664	1120	RunDll32.exe	30
PID 1120 wrote to memory of 1664	1120	RunDll32.exe	30
PID 1120 wrote to memory of 1664	1120	RunDll32.exe	30
PID 1120 wrote to memory of 1664	1120	RunDll32.exe	30
PID 1120 wrote to memory of 1664	1120	RunDll32.exe	30

C:\Users\Admin\AppData\Local\Temp\1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8.exe
"C:\Users\Admin\AppData\Local\Temp\1fbf7418849df1bdd2c3c6baad8f948343f62e9e4dc99faf715254293b9599b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\3W9UKK.CPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3W9UKK.CPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3W9UKK.CPL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\3W9UKK.CPL",
        5⤵
        Loads dropped DLL
        
        PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3W9UKK.CPL

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
\Users\Admin\AppData\Local\Temp\3W9UKk.cpl

Filesize
1.4MB

MD5
06b851452ca6efc030bdc63847df3066

SHA1
9b0e47da6b7cf33bef5a61dd54a0dd6a076b4a02

SHA256
1d7943570879d97ff686ddc70bd0faec75d84ce8f4626556623eddaec811e997

SHA512
0489e651277f1372cf047bbc9dcb03670bd72665a74158cf547ec613095138834da14d83d804d9c2205c6a94e998d7ed57bf8df01d83422489b69ee1f10f4275

Download Submit
memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1664-80-0x00000000020F0000-0x0000000002D3A000-memory.dmp

Filesize
12.3MB

Download
memory/1664-81-0x00000000020F0000-0x0000000002D3A000-memory.dmp

Filesize
12.3MB

Download
memory/1664-82-0x00000000020F0000-0x0000000002D3A000-memory.dmp

Filesize
12.3MB

Download
memory/1664-86-0x00000000029B0000-0x0000000002A7C000-memory.dmp

Filesize
816KB

Download
memory/1984-71-0x00000000029C0000-0x0000000002A8C000-memory.dmp

Filesize
816KB

Download
memory/1984-68-0x0000000000BB0000-0x0000000000C93000-memory.dmp

Filesize
908KB

Download
memory/1984-65-0x00000000020F0000-0x0000000002D3A000-memory.dmp

Filesize
12.3MB

Download
memory/1984-64-0x0000000000A40000-0x0000000000BAA000-memory.dmp

Filesize
1.4MB

Download
memory/1984-67-0x00000000020F0000-0x0000000002D3A000-memory.dmp

Filesize
12.3MB

Download
memory/1984-66-0x00000000020F0000-0x0000000002D3A000-memory.dmp

Filesize
12.3MB

Download