Overview
overview
8Static
static
IMG_1163_O...er.exe
windows10-1703-x64
8IMG_1329_O...er.exe
windows10-1703-x64
1IMG_1547_O...er.exe
windows10-1703-x64
8IMG_1871_O...er.exe
windows10-1703-x64
8IMG_2038_O...er.exe
windows10-1703-x64
8IMG_2512_O...er.exe
windows10-1703-x64
8IMG_2755_O...er.exe
windows10-1703-x64
8IMG_3424_O...er.exe
windows10-1703-x64
8IMG_3803_O...er.exe
windows10-1703-x64
8IMG_4298_O...er.exe
windows10-1703-x64
8IMG_4516_O...er.exe
windows10-1703-x64
1IMG_4681_O...er.exe
windows10-1703-x64
8IMG_5063_O...er.exe
windows10-1703-x64
8IMG_5727_O...er.exe
windows10-1703-x64
8IMG_6131_O...er.exe
windows10-1703-x64
8IMG_6280_O...er.exe
windows10-1703-x64
8IMG_6578_O...er.exe
windows10-1703-x64
8IMG_7012_O...er.exe
windows10-1703-x64
8IMG_7284_O...er.exe
windows10-1703-x64
8IMG_7460_O...er.exe
windows10-1703-x64
8IMG_7923_O...er.exe
windows10-1703-x64
8IMG_8258_O...er.exe
windows10-1703-x64
8IMG_8341_O...er.exe
windows10-1703-x64
8IMG_8616_O...er.exe
windows10-1703-x64
8IMG_9070_O...er.exe
windows10-1703-x64
8IMG_9539_O...er.exe
windows10-1703-x64
8WDLocale.dll
windows10-1703-x64
1WDSync.dll
windows10-1703-x64
1Analysis
-
max time kernel
47s -
max time network
80s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
12-01-2023 10:30
Static task
static1
Behavioral task
behavioral1
Sample
IMG_1163_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
IMG_1329_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
IMG_1547_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral4
Sample
IMG_1871_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
IMG_2038_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220901-en
Behavioral task
behavioral6
Sample
IMG_2512_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral7
Sample
IMG_2755_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral8
Sample
IMG_3424_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral9
Sample
IMG_3803_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220901-en
Behavioral task
behavioral10
Sample
IMG_4298_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral11
Sample
IMG_4516_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral12
Sample
IMG_4681_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral13
Sample
IMG_5063_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220901-en
Behavioral task
behavioral14
Sample
IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220901-en
Behavioral task
behavioral15
Sample
IMG_6131_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral16
Sample
IMG_6280_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral17
Sample
IMG_6578_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral18
Sample
IMG_7012_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral19
Sample
IMG_7284_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral20
Sample
IMG_7460_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral21
Sample
IMG_7923_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220901-en
Behavioral task
behavioral22
Sample
IMG_8258_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral23
Sample
IMG_8341_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral24
Sample
IMG_8616_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220901-en
Behavioral task
behavioral25
Sample
IMG_9070_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral26
Sample
IMG_9539_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Resource
win10-20220812-en
Behavioral task
behavioral27
Sample
WDLocale.dll
Resource
win10-20220901-en
Behavioral task
behavioral28
Sample
WDSync.dll
Resource
win10-20220812-en
General
-
Target
IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
-
Size
153KB
-
MD5
37932fd952d6d845927f25f42cb3c628
-
SHA1
d0d7e1b7cfb13a0999ef4c4733b83275a1de2440
-
SHA256
cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c
-
SHA512
403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b
-
SSDEEP
1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4248 TS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2984 4792 WerFault.exe 65 -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4792 wrote to memory of 4248 4792 IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe 66 PID 4792 wrote to memory of 4248 4792 IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe"C:\Users\Admin\AppData\Local\Temp\IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\TS.exe"C:\Users\Admin\AppData\Local\Temp\TS.exe" t2⤵
- Executes dropped EXE
PID:4248
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4792 -s 22482⤵
- Program crash
PID:2984
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.0MB
MD58756a6c94b0fca6261a1a58d31e776da
SHA15d815c0af3ec117178118bfb20dd6ebcf298d116
SHA25601bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea
SHA51296f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570
-
Filesize
24.0MB
MD58756a6c94b0fca6261a1a58d31e776da
SHA15d815c0af3ec117178118bfb20dd6ebcf298d116
SHA25601bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea
SHA51296f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570