2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7

Analysis

max time kernel
22s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/02/2023, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe
Size

2.3MB
MD5

2287a0900acb8a85fb47034f7b6a49f1
SHA1

37fc51cd38f24cc84306622792367036b08f69d4
SHA256

2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7
SHA512

44dcf26515290af48d6f69bc59d08b026d6305670ca566cfee97b14e8987e799ef2bdda2e2bd663cc486655a600f0d68fed3ffead93bf334772155435027fdfc
SSDEEP

49152:h2VPyRHpIKgXC7RNd7vvbry9/3BstiOLsLTH1l1evYfI3KJmNZhxu0Ow46v6:kRyRH7gXC797b+9W/LsLTHLfoXNrgUv6

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp
760	LizFlashFixSetup.exe

Loads dropped DLL 6 IoCs

pid	Process
2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe
1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp
1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp
1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp
1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp
1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\clFlow	LizFlashFixSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1988	2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe	28
PID 2040 wrote to memory of 1988	2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe	28
PID 2040 wrote to memory of 1988	2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe	28
PID 2040 wrote to memory of 1988	2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe	28
PID 2040 wrote to memory of 1988	2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe	28
PID 2040 wrote to memory of 1988	2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe	28
PID 2040 wrote to memory of 1988	2040	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe	28
PID 1988 wrote to memory of 760	1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp	29
PID 1988 wrote to memory of 760	1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp	29
PID 1988 wrote to memory of 760	1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp	29
PID 1988 wrote to memory of 760	1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp	29
PID 1988 wrote to memory of 760	1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp	29
PID 1988 wrote to memory of 760	1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp	29
PID 1988 wrote to memory of 760	1988	2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp	29

C:\Users\Admin\AppData\Local\Temp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe
"C:\Users\Admin\AppData\Local\Temp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\is-BV7LU.tmp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BV7LU.tmp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp" /SL5="$70122,2138949,257024,C:\Users\Admin\AppData\Local\Temp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\LizFlashFixSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\LizFlashFixSetup.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-BV7LU.tmp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp

Filesize
676KB

MD5
f8fe5c31980e25943de62acd165189b2

SHA1
c64ca3e0c19d37c9a7c8e01285fbfbf791fb44f4

SHA256
bd608527c2ad1989185416f5e687e9cc824c0466db4d9bc84bde6b3af6000d40

SHA512
368fe292a5a358a5b3df0dd31953444bee2cdfbeb48b5b41f3318ae007356d9d2779c1d45f3c9d9eeb53bdb8f7e3f25efd9e0a05a43ae892da3c987c9d6c5ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BV7LU.tmp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp

Filesize
676KB

MD5
f8fe5c31980e25943de62acd165189b2

SHA1
c64ca3e0c19d37c9a7c8e01285fbfbf791fb44f4

SHA256
bd608527c2ad1989185416f5e687e9cc824c0466db4d9bc84bde6b3af6000d40

SHA512
368fe292a5a358a5b3df0dd31953444bee2cdfbeb48b5b41f3318ae007356d9d2779c1d45f3c9d9eeb53bdb8f7e3f25efd9e0a05a43ae892da3c987c9d6c5ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\LizFlashFixSetup.exe

Filesize
3.1MB

MD5
788ed815aa0599c4a3cea7d43df4cce6

SHA1
e8c9a112f35fcf2c790e0e813089a08a6332eb6d

SHA256
1cf49c356bca164e11c7dc1bb66b9ffc9eba14de5e7485011feba1452d7009cc

SHA512
0603b01de87e48bd62e5e0f7f23f6163f58e3dc2099cae62378b0f0d75f3834511399e2effe3527b1947ee1c600991e9c51600eed6447f2fc71121e9f9c8787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\LizFlashFixSetup.exe

Filesize
3.1MB

MD5
788ed815aa0599c4a3cea7d43df4cce6

SHA1
e8c9a112f35fcf2c790e0e813089a08a6332eb6d

SHA256
1cf49c356bca164e11c7dc1bb66b9ffc9eba14de5e7485011feba1452d7009cc

SHA512
0603b01de87e48bd62e5e0f7f23f6163f58e3dc2099cae62378b0f0d75f3834511399e2effe3527b1947ee1c600991e9c51600eed6447f2fc71121e9f9c8787e

Download Submit
\Users\Admin\AppData\Local\Temp\is-BV7LU.tmp\2e3a55b7ac902c9a6e24e503a0582c5df7c884d4da52d12ae62766d275ba43d7.tmp

Filesize
676KB

MD5
f8fe5c31980e25943de62acd165189b2

SHA1
c64ca3e0c19d37c9a7c8e01285fbfbf791fb44f4

SHA256
bd608527c2ad1989185416f5e687e9cc824c0466db4d9bc84bde6b3af6000d40

SHA512
368fe292a5a358a5b3df0dd31953444bee2cdfbeb48b5b41f3318ae007356d9d2779c1d45f3c9d9eeb53bdb8f7e3f25efd9e0a05a43ae892da3c987c9d6c5ef5

Download Submit
\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\LizFlashFixSetup.exe

Filesize
3.1MB

MD5
788ed815aa0599c4a3cea7d43df4cce6

SHA1
e8c9a112f35fcf2c790e0e813089a08a6332eb6d

SHA256
1cf49c356bca164e11c7dc1bb66b9ffc9eba14de5e7485011feba1452d7009cc

SHA512
0603b01de87e48bd62e5e0f7f23f6163f58e3dc2099cae62378b0f0d75f3834511399e2effe3527b1947ee1c600991e9c51600eed6447f2fc71121e9f9c8787e

Download Submit
\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-D9Q6A.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/760-72-0x0000000000400000-0x0000000001323000-memory.dmp

Filesize
15.1MB

Download
memory/760-73-0x0000000000400000-0x0000000001323000-memory.dmp

Filesize
15.1MB

Download
memory/760-75-0x0000000000400000-0x0000000001323000-memory.dmp

Filesize
15.1MB

Download
memory/760-76-0x0000000000400000-0x0000000001323000-memory.dmp

Filesize
15.1MB

Download
memory/1988-71-0x0000000002FE0000-0x0000000003F03000-memory.dmp

Filesize
15.1MB

Download
memory/2040-66-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2040-54-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2040-77-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download