Resubmissions

12-01-2023 13:20

230112-qk7arsbg9w 8

12-01-2023 10:30

230112-mjzyhsbe5s 8

Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-01-2023 10:30

General

  • Target

    IMG_6280_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe

  • Size

    153KB

  • MD5

    37932fd952d6d845927f25f42cb3c628

  • SHA1

    d0d7e1b7cfb13a0999ef4c4733b83275a1de2440

  • SHA256

    cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c

  • SHA512

    403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b

  • SSDEEP

    1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IMG_6280_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
    "C:\Users\Admin\AppData\Local\Temp\IMG_6280_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Local\Temp\TS.exe
      "C:\Users\Admin\AppData\Local\Temp\TS.exe" t
      2⤵
      • Executes dropped EXE
      PID:3780
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1616 -s 2236
      2⤵
      • Program crash
      PID:4836

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TS.exe

    Filesize

    24.0MB

    MD5

    8756a6c94b0fca6261a1a58d31e776da

    SHA1

    5d815c0af3ec117178118bfb20dd6ebcf298d116

    SHA256

    01bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea

    SHA512

    96f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570

  • C:\Users\Admin\AppData\Local\Temp\TS.exe

    Filesize

    24.0MB

    MD5

    8756a6c94b0fca6261a1a58d31e776da

    SHA1

    5d815c0af3ec117178118bfb20dd6ebcf298d116

    SHA256

    01bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea

    SHA512

    96f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570

  • memory/1616-126-0x0000023EEC660000-0x0000023EEC672000-memory.dmp

    Filesize

    72KB

  • memory/1616-123-0x0000023EEB6E0000-0x0000023EEB6F8000-memory.dmp

    Filesize

    96KB

  • memory/1616-124-0x0000023EEB700000-0x0000023EEB724000-memory.dmp

    Filesize

    144KB

  • memory/1616-125-0x0000023EEC630000-0x0000023EEC63C000-memory.dmp

    Filesize

    48KB

  • memory/1616-120-0x0000023EE9370000-0x0000023EE9398000-memory.dmp

    Filesize

    160KB

  • memory/1616-127-0x0000023EEC6E0000-0x0000023EEC71E000-memory.dmp

    Filesize

    248KB

  • memory/1616-128-0x0000023EEC830000-0x0000023EEC93A000-memory.dmp

    Filesize

    1.0MB

  • memory/1616-129-0x0000023EF8890000-0x0000023EFA8BA000-memory.dmp

    Filesize

    32.2MB

  • memory/1616-122-0x0000023EEB6D0000-0x0000023EEB6DC000-memory.dmp

    Filesize

    48KB

  • memory/1616-121-0x0000023EED6C0000-0x0000023EEF73E000-memory.dmp

    Filesize

    32.5MB

  • memory/3780-130-0x0000000000000000-mapping.dmp

  • memory/3780-133-0x0000000000390000-0x0000000001B90000-memory.dmp

    Filesize

    24.0MB