a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46

General

Target

a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
Size

44KB
MD5

c159afb7d2111690326cad610776db34
SHA1

228239d1bf7020ecdc4021f3c20a14041b210d78
SHA256

a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46
SHA512

116f754bfb5d9efd73bdd9a8aaa004e6661248a7e726db54a810e581f7b6fd8f9306c858334c67fe5932d18dfaef015117a0c9a4e57efa2deb3610fa24ccb5bf
SSDEEP

768:DKliIdJ0BEgMYojM5Ar/xY6Xc4FSimT3oDz/KVAhuxYFk:+ddiB5kM5Ar/S6Xc4FnmT3oDz/KVCuI

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ExpandMove.tif => C:\Users\Admin\Pictures\ExpandMove.tif.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File renamed	C:\Users\Admin\Pictures\GetUnlock.crw => C:\Users\Admin\Pictures\GetUnlock.crw.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened for modification	C:\Users\Admin\Pictures\GetUnlock.crw.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File renamed	C:\Users\Admin\Pictures\UndoDisable.raw => C:\Users\Admin\Pictures\UndoDisable.raw.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened for modification	C:\Users\Admin\Pictures\DisconnectClose.tiff.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened for modification	C:\Users\Admin\Pictures\ExpandMove.tif.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened for modification	C:\Users\Admin\Pictures\UndoDisable.raw.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File renamed	C:\Users\Admin\Pictures\UpdateMount.crw => C:\Users\Admin\Pictures\UpdateMount.crw.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened for modification	C:\Users\Admin\Pictures\UpdateMount.crw.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File renamed	C:\Users\Admin\Pictures\DisconnectClose.tiff => C:\Users\Admin\Pictures\DisconnectClose.tiff.NOKOYAWA	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\O:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\P:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\G:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\H:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\L:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\W:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\T:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\Y:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\I:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\F:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\Z:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\X:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\N:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\E:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\R:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\U:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\A:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\S:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\K:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\J:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\V:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\B:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
File opened (read-only)	\??\M:	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe

C:\Users\Admin\AppData\Local\Temp\a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe
"C:\Users\Admin\AppData\Local\Temp\a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing