8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2

General

Target

8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe
Size

9.5MB
MD5

7320fc987625b26f9b7093f6df39c1f0
SHA1

4155260516f97dfb6a5b60a1e5079c8d403909ab
SHA256

8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2
SHA512

cc70fc317810e51b989693b07de3e79ed820aadb4554cf4629a2ec53afa73e9e9276ab5b8ac73eb048b3f929a77e3fa832ff706b15bdbca4b674e02128a12692
SSDEEP

196608:2Ujw2hNDblKeS3RmybcydEpWa6T+KOnblEkIyi7RtPlUWaNUgg1:2ghNDg3YUCkCKUbKkM7rlUWNr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2040	is-79LEV.tmp

Loads dropped DLL 4 IoCs

pid	Process
1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe
2040	is-79LEV.tmp
2040	is-79LEV.tmp
2040	is-79LEV.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2040	1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe	28
PID 1636 wrote to memory of 2040	1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe	28
PID 1636 wrote to memory of 2040	1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe	28
PID 1636 wrote to memory of 2040	1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe	28
PID 1636 wrote to memory of 2040	1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe	28
PID 1636 wrote to memory of 2040	1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe	28
PID 1636 wrote to memory of 2040	1636	8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe	28

C:\Users\Admin\AppData\Local\Temp\8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe
"C:\Users\Admin\AppData\Local\Temp\8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\is-E4I4F.tmp\is-79LEV.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-E4I4F.tmp\is-79LEV.tmp" /SL4 $60126 "C:\Users\Admin\AppData\Local\Temp\8f699f1a246404bc4a2a221a4b02e53c24c640dcbd1425671b79a4b49825bfb2.exe" 9693294 51200
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-E4I4F.tmp\is-79LEV.tmp

Filesize
645KB

MD5
b648dcea8917936fb4eddbea705ac5b4

SHA1
d78a35c8bae12e63aac254250f1e0ace1a1f296a

SHA256
af8f25091dea9d69bba24be8ed54ae8d5bb9d48fcc1467a80d4b0a161c585e82

SHA512
e333271ed2a541db8fddd4a3b16b87ff4db923658bff7d703ab3d372cc857c6ade043abad6285584425c17610bc5587ef1477ca66a79c9412a3244856d2c8cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E4I4F.tmp\is-79LEV.tmp

Filesize
645KB

MD5
b648dcea8917936fb4eddbea705ac5b4

SHA1
d78a35c8bae12e63aac254250f1e0ace1a1f296a

SHA256
af8f25091dea9d69bba24be8ed54ae8d5bb9d48fcc1467a80d4b0a161c585e82

SHA512
e333271ed2a541db8fddd4a3b16b87ff4db923658bff7d703ab3d372cc857c6ade043abad6285584425c17610bc5587ef1477ca66a79c9412a3244856d2c8cdc

Download Submit
\Users\Admin\AppData\Local\Temp\is-04K90.tmp\SetupDll.dll

Filesize
152KB

MD5
6433d3bc70bbe55ddf8fed58a49a2b93

SHA1
38de9cc06b34386a1220c5713d189dd2c2c3ec42

SHA256
fedfcdd244d7a4ff4c5077897232d2d63ed3c87ef9a441228ebe2ca2a4dc2d6f

SHA512
9d11d6509e3e21626d4d99a7845fdecb3b1bff16b135951c403f3fec6b9ea7003e69055f33ca2388817e2f7086fe0d7065a749532332c3869469dca951357f15

Download Submit
\Users\Admin\AppData\Local\Temp\is-04K90.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
cd5f1df7f0ab102e7dce07e65cc22b8d

SHA1
72112750efb3ccf53b63f4f03ba7f0a9281bd24b

SHA256
1e0cfcff73a52671ad30bc7574725bbf5609c89b5c5883e3bb9f24eea59f22b0

SHA512
233ee28d9eefff59292f475a58f902a6dc4aa5c465c915c3ce8577b32bddfe12fdfeff0d5a48021614159f4ab28d1f9d431421bc2a3c64e52bf4691b3b84dafc

Download Submit
\Users\Admin\AppData\Local\Temp\is-04K90.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
cd5f1df7f0ab102e7dce07e65cc22b8d

SHA1
72112750efb3ccf53b63f4f03ba7f0a9281bd24b

SHA256
1e0cfcff73a52671ad30bc7574725bbf5609c89b5c5883e3bb9f24eea59f22b0

SHA512
233ee28d9eefff59292f475a58f902a6dc4aa5c465c915c3ce8577b32bddfe12fdfeff0d5a48021614159f4ab28d1f9d431421bc2a3c64e52bf4691b3b84dafc

Download Submit
\Users\Admin\AppData\Local\Temp\is-E4I4F.tmp\is-79LEV.tmp

Filesize
645KB

MD5
b648dcea8917936fb4eddbea705ac5b4

SHA1
d78a35c8bae12e63aac254250f1e0ace1a1f296a

SHA256
af8f25091dea9d69bba24be8ed54ae8d5bb9d48fcc1467a80d4b0a161c585e82

SHA512
e333271ed2a541db8fddd4a3b16b87ff4db923658bff7d703ab3d372cc857c6ade043abad6285584425c17610bc5587ef1477ca66a79c9412a3244856d2c8cdc

Download Submit
memory/1636-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1636-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1636-65-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing