Resubmissions

12-01-2023 13:20

230112-qk7arsbg9w 8

12-01-2023 10:30

230112-mjzyhsbe5s 8

Analysis

  • max time kernel
    47s
  • max time network
    80s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-01-2023 10:30

General

  • Target

    IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe

  • Size

    153KB

  • MD5

    37932fd952d6d845927f25f42cb3c628

  • SHA1

    d0d7e1b7cfb13a0999ef4c4733b83275a1de2440

  • SHA256

    cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c

  • SHA512

    403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b

  • SSDEEP

    1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
    "C:\Users\Admin\AppData\Local\Temp\IMG_5727_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\TS.exe
      "C:\Users\Admin\AppData\Local\Temp\TS.exe" t
      2⤵
      • Executes dropped EXE
      PID:4248
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4792 -s 2248
      2⤵
      • Program crash
      PID:2984

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TS.exe

    Filesize

    24.0MB

    MD5

    8756a6c94b0fca6261a1a58d31e776da

    SHA1

    5d815c0af3ec117178118bfb20dd6ebcf298d116

    SHA256

    01bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea

    SHA512

    96f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570

  • C:\Users\Admin\AppData\Local\Temp\TS.exe

    Filesize

    24.0MB

    MD5

    8756a6c94b0fca6261a1a58d31e776da

    SHA1

    5d815c0af3ec117178118bfb20dd6ebcf298d116

    SHA256

    01bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea

    SHA512

    96f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570

  • memory/4248-133-0x0000000000370000-0x0000000001B70000-memory.dmp

    Filesize

    24.0MB

  • memory/4248-130-0x0000000000000000-mapping.dmp

  • memory/4792-126-0x0000014B30710000-0x0000014B30722000-memory.dmp

    Filesize

    72KB

  • memory/4792-125-0x0000014B306E0000-0x0000014B306EC000-memory.dmp

    Filesize

    48KB

  • memory/4792-120-0x0000014B2E9E0000-0x0000014B2EA08000-memory.dmp

    Filesize

    160KB

  • memory/4792-127-0x0000014B30770000-0x0000014B307AE000-memory.dmp

    Filesize

    248KB

  • memory/4792-128-0x0000014B49390000-0x0000014B4949A000-memory.dmp

    Filesize

    1.0MB

  • memory/4792-129-0x0000014B55010000-0x0000014B5703A000-memory.dmp

    Filesize

    32.2MB

  • memory/4792-124-0x0000014B2ED50000-0x0000014B2ED74000-memory.dmp

    Filesize

    144KB

  • memory/4792-123-0x0000014B2ED30000-0x0000014B2ED48000-memory.dmp

    Filesize

    96KB

  • memory/4792-122-0x0000014B2ED20000-0x0000014B2ED2C000-memory.dmp

    Filesize

    48KB

  • memory/4792-121-0x0000014B4AF90000-0x0000014B4D00E000-memory.dmp

    Filesize

    32.5MB