9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0

Analysis

max time kernel
50s
max time network
181s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
28/12/2022, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0.exe
Size

1.6MB
MD5

1bf490aea60c0756c8f5de20ee206a5d
SHA1

074b8bf683a238f31ec94a95f72ccb3f3373165e
SHA256

9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0
SHA512

2739002a0c634ba8b9469dd27101a5d495d88c7ee80a31cf82a08de888e00a9afef1890c26302b72fe8f8f44b4700d5a27089ad557b9d3183fd0548c3a1bb50d
SSDEEP

24576:4ry2uXzmVLme9hzF8wMu8IdT7DqztWUzwE2og0xiQ+Mk1G+ulmPjUnbYjBV4BnMR:4unE9hzvRWzt4E2r0x8Mkkm7CbYzOnM

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3680	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3680	3488	9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0.exe	66
PID 3488 wrote to memory of 3680	3488	9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0.exe	66
PID 3488 wrote to memory of 3680	3488	9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0.exe	66

C:\Users\Admin\AppData\Local\Temp\9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0.exe
"C:\Users\Admin\AppData\Local\Temp\9f98189ccaa797231a8ad35e236134b907f143757c772620b08f5d917ed2a1e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Y .\VXwF7X~.H
  2⤵
  - Loads dropped DLL
  PID:3680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VXwF7X~.H

Filesize
1.6MB

MD5
735827ec55958029ffe43ae94bcd79f8

SHA1
e6ea89b583fbbc23ce5b3a3eec3829c3060500f0

SHA256
567482a5a465e44855adeb2f79b96100f1a32d9be13b6effbe7d137e03ab576c

SHA512
e58fd7d21f473d717b8406bdf5755ac1fdd9a1df7307fc325b0bc32106490aa49245a07d6d451931cfff6132d3c10651331126f682cf4ab1ca7eac81728a977d

Download Submit
\Users\Admin\AppData\Local\Temp\vXwf7x~.H

Filesize
1.6MB

MD5
735827ec55958029ffe43ae94bcd79f8

SHA1
e6ea89b583fbbc23ce5b3a3eec3829c3060500f0

SHA256
567482a5a465e44855adeb2f79b96100f1a32d9be13b6effbe7d137e03ab576c

SHA512
e58fd7d21f473d717b8406bdf5755ac1fdd9a1df7307fc325b0bc32106490aa49245a07d6d451931cfff6132d3c10651331126f682cf4ab1ca7eac81728a977d

Download Submit
memory/3488-116-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-117-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-118-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-119-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-121-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-122-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-124-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-125-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-126-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-127-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-128-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-129-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-131-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-130-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-132-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-133-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-134-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-135-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-136-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-137-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-138-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-139-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-140-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-141-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-142-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-143-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-144-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-145-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-146-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-147-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-148-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-149-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-150-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-151-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-152-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-153-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-154-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-155-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-156-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-157-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-158-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-159-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-160-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-161-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-162-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-163-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-164-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-165-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-166-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-167-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-168-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-169-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-170-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-171-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-172-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-173-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-174-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-175-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-176-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-177-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-178-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-179-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-180-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3488-181-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3680-232-0x0000000072120000-0x00000000722B1000-memory.dmp

Filesize
1.6MB

Download
memory/3680-231-0x0000000004890000-0x0000000004A19000-memory.dmp

Filesize
1.5MB

Download