571018b65a1137c05d0f256bc01ed26dc091e42b6cdcab8e91e9ff80d3da01d6

Resubmissions

12/01/2023, 13:20

230112-qk7arsbg9w 8

12/01/2023, 10:30

230112-mjzyhsbe5s 8

Analysis

max time kernel
50s
max time network
72s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
12/01/2023, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

IMG_8341_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
Size

153KB
MD5

37932fd952d6d845927f25f42cb3c628
SHA1

d0d7e1b7cfb13a0999ef4c4733b83275a1de2440
SHA256

cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c
SHA512

403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b
SSDEEP

1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5072	TS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3592	4248	WerFault.exe	65

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 5072	4248	IMG_8341_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe	67
PID 4248 wrote to memory of 5072	4248	IMG_8341_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe	67

C:\Users\Admin\AppData\Local\Temp\IMG_8341_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_8341_One_Night_Stand_Li_Shaw - Hwang_Chung_Wa_Studio - By_Gal_Dong_Min_Photographer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\TS.exe
  "C:\Users\Admin\AppData\Local\Temp\TS.exe" t
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4248 -s 2208
  2⤵
  - Program crash
  PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TS.exe

Filesize
24.0MB

MD5
8756a6c94b0fca6261a1a58d31e776da

SHA1
5d815c0af3ec117178118bfb20dd6ebcf298d116

SHA256
01bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea

SHA512
96f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570

Download Submit
C:\Users\Admin\AppData\Local\Temp\TS.exe

Filesize
24.0MB

MD5
8756a6c94b0fca6261a1a58d31e776da

SHA1
5d815c0af3ec117178118bfb20dd6ebcf298d116

SHA256
01bb63f7f8093ef99140a56bc1a3006441b576bff532920bdf7173efd1a7fbea

SHA512
96f314f840edfe51ff6cfcd385a654cb2f7399fcb377ebfa70f9a11665774f138ff84e35ef0f116e4151f8d2afd421ec4a528c0555c7f4ad64ac673b7406c570

Download Submit
memory/4248-125-0x00000228F9890000-0x00000228F98A2000-memory.dmp

Filesize
72KB

Download
memory/4248-122-0x00000228F9760000-0x00000228F9778000-memory.dmp

Filesize
96KB

Download
memory/4248-123-0x00000228F97B0000-0x00000228F97D4000-memory.dmp

Filesize
144KB

Download
memory/4248-124-0x00000228F9790000-0x00000228F979C000-memory.dmp

Filesize
48KB

Download
memory/4248-119-0x00000228F9410000-0x00000228F9438000-memory.dmp

Filesize
160KB

Download
memory/4248-126-0x00000228FB9D0000-0x00000228FBA0E000-memory.dmp

Filesize
248KB

Download
memory/4248-127-0x00000228FBB90000-0x00000228FBC9A000-memory.dmp

Filesize
1.0MB

Download
memory/4248-128-0x00000228A0000000-0x00000228A202A000-memory.dmp

Filesize
32.2MB

Download
memory/4248-121-0x00000228F9750000-0x00000228F975C000-memory.dmp

Filesize
48KB

Download
memory/4248-120-0x00000228FDA10000-0x00000228FFA8E000-memory.dmp

Filesize
32.5MB

Download
memory/5072-132-0x0000000000780000-0x0000000001F80000-memory.dmp

Filesize
24.0MB

Download