Analysis
-
max time kernel
69s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29-12-2022 16:30
General
-
Target
file.exe
-
Size
1.9MB
-
MD5
913e143128f73cb55e85882c86555ad7
-
SHA1
0774a64ba0e7caafd711584e0eab418c504d1aa2
-
SHA256
263cf6e3beb5a051135af6126b126b6c3c3d926a0fdaa2cf010476d221c271d4
-
SHA512
36ea094ded09cad926ea1b58b4eaeaac4634798b075b1769e9d9f67bf999217576d6839051994b134357eee675ebcda8cabdb68229ffae75a82d3e3b0ea8406c
-
SSDEEP
49152:Bih2AtJkqdle+Qf5GO+7iZMEW0EbElNBH4+Hth96r:BiVar5G1iCEWtYZH4+HtH2
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EN2CS.tmp\is-GCHIO.tmp"C:\Users\Admin\AppData\Local\Temp\is-EN2CS.tmp\is-GCHIO.tmp" /SL4 $B0050 "C:\Users\Admin\AppData\Local\Temp\file.exe" 1740255 1664002⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Split Files\SplitFiles124.exe"C:\Program Files (x86)\Split Files\SplitFiles124.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5cd0b1262da58b6674d8b1557408e79cd
SHA1ebd0360bfab85d79b80e6555b868cbbe3d53901a
SHA2561ac2ecf7469437ae373dacf32fcd4f913c4b286caf26a8eead1ed8d433d43d03
SHA512e8d35f23f2e2b0865cd338dbe6e3f3c43969139abaf5d64427c6d509e4f99bd4cdb835d79934209086228b6a849e3eaff199f599ec7cc538545dbce10ce75bc2
-
Filesize
3.2MB
MD5cd0b1262da58b6674d8b1557408e79cd
SHA1ebd0360bfab85d79b80e6555b868cbbe3d53901a
SHA2561ac2ecf7469437ae373dacf32fcd4f913c4b286caf26a8eead1ed8d433d43d03
SHA512e8d35f23f2e2b0865cd338dbe6e3f3c43969139abaf5d64427c6d509e4f99bd4cdb835d79934209086228b6a849e3eaff199f599ec7cc538545dbce10ce75bc2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
756KB
MD588c7387a76635a30298c1fea18eb963d
SHA18a01e609d9f076fd09ec9eec99b512c3571efdbc
SHA2560cf25da416c0de0814b116f3b917412415e285622149b82d6ee701d94316427b
SHA512e3d7736fa09f81ff239ce20b9c7cfacc171b63a215f5658c0de9f57dfbb4b9fb7dd96875ecacd7e652d06ff100fa4f7fca63ba2688d48b122bf03c8dbd08ad2b
-
Filesize
756KB
MD588c7387a76635a30298c1fea18eb963d
SHA18a01e609d9f076fd09ec9eec99b512c3571efdbc
SHA2560cf25da416c0de0814b116f3b917412415e285622149b82d6ee701d94316427b
SHA512e3d7736fa09f81ff239ce20b9c7cfacc171b63a215f5658c0de9f57dfbb4b9fb7dd96875ecacd7e652d06ff100fa4f7fca63ba2688d48b122bf03c8dbd08ad2b
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
17.2MB
-
Filesize
17.2MB