f4a6e60a7ee010bef6cb4ea0d9548d48ca5d7415336feff957eed8c043ead2b1

Analysis

max time kernel
172s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DSG2011001_INV+PL.exe
Size 308KB
Sample230209-hlchsage92
SHA256 f4a6e60a7ee010bef6cb4ea0d9548d48ca5d7415336feff957eed8c043ead2b1
MD5 4b75a6e118d94db850863558197d5f21
SHA1 aa8d6f692c189ac89795020a0933b28cd6f82a90
SHA512 463fea084f2957ae4bf61cfb80c990e50babd22a7589eacbd66d6e0f0b7f19afeb3a3b3bb81bd7700e04b7a944d7b286653e2ab68695a9de4405ec2ed7ea779a
SSDEEP 6144:vYa67XLqVXgnM/7xu2z2sW3txgC7/RdAAKIv1WMOtjAwrvMa:vYhX6/7/2sW3ti2h9W9tjVvL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3140	jnmfjri.exe
1152	jnmfjri.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3140 set thread context of 1152	3140	jnmfjri.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4152	1152	WerFault.exe	81

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3140	jnmfjri.exe
3140	jnmfjri.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3140	3952	DSG2011001_INV+PL.exe	80
PID 3952 wrote to memory of 3140	3952	DSG2011001_INV+PL.exe	80
PID 3952 wrote to memory of 3140	3952	DSG2011001_INV+PL.exe	80
PID 3140 wrote to memory of 1152	3140	jnmfjri.exe	81
PID 3140 wrote to memory of 1152	3140	jnmfjri.exe	81
PID 3140 wrote to memory of 1152	3140	jnmfjri.exe	81
PID 3140 wrote to memory of 1152	3140	jnmfjri.exe	81

C:\Users\Admin\AppData\Local\Temp\DSG2011001_INV+PL.exe
"C:\Users\Admin\AppData\Local\Temp\DSG2011001_INV+PL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\jnmfjri.exe
  "C:\Users\Admin\AppData\Local\Temp\jnmfjri.exe" C:\Users\Admin\AppData\Local\Temp\mbbvsulqzqv.b
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Users\Admin\AppData\Local\Temp\jnmfjri.exe
    "C:\Users\Admin\AppData\Local\Temp\jnmfjri.exe"
    3⤵
    - Executes dropped EXE
    PID:1152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 184
      4⤵
      Program crash
      PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1152 -ip 1152
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

idein.dro

Path C:\Users\Admin\AppData\Local\Temp\idein.dro
Size 206KB
SHA256 1709150330e3dea625c3e56235b2c5824d997d73377f6aa3f55e6d4cec425801
MD5 8b2d1acd058db5c36d342690e323b978
SHA1 5a2c8f1cfa4455ae6f104722bba636537c62b49f
SHA512 5c2c34d459170d739ab98fe3617f00a623283b58437596fb9f9d95a4f6001559213b1051511b1ef01fd07beae88c0c9d964fcd78facf172bd06c740bef3762a9
SSDEEP 6144:k37iOyf5sl4FaqOMwe8NtmHBHfNZ55/omcg:m7457FaqOJecghHfNZEmcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnmfjri.exe

Path C:\Users\Admin\AppData\Local\Temp\jnmfjri.exe
Size 122KB
SHA256 83d072c29de9ede240bd1a69c347f8fe7f42a3472dc2a1fe404058e1cf7051b3
MD5 d7f4751e0cee2d8120bdba38bac7c464
SHA1 43ed503448a0fedb606adf47fbcf28d3728ea295
SHA512 8ce087ccf119a806ea3b2b74414b94fea3540569e2c2abde8da88d4c94261f3060e2cd4cca9e82ec0a29f773d5c87e4d7ecaf616f51f867fdb0b700a69a9cdfc
SSDEEP 3072:whfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPvVaDAi:IJJtBYcpn/ez7pzkCi+Ai
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnmfjri.exe

Path C:\Users\Admin\AppData\Local\Temp\jnmfjri.exe
Size 122KB
SHA256 83d072c29de9ede240bd1a69c347f8fe7f42a3472dc2a1fe404058e1cf7051b3
MD5 d7f4751e0cee2d8120bdba38bac7c464
SHA1 43ed503448a0fedb606adf47fbcf28d3728ea295
SHA512 8ce087ccf119a806ea3b2b74414b94fea3540569e2c2abde8da88d4c94261f3060e2cd4cca9e82ec0a29f773d5c87e4d7ecaf616f51f867fdb0b700a69a9cdfc
SSDEEP 3072:whfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPvVaDAi:IJJtBYcpn/ez7pzkCi+Ai
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnmfjri.exe

Path C:\Users\Admin\AppData\Local\Temp\jnmfjri.exe
Size 122KB
SHA256 83d072c29de9ede240bd1a69c347f8fe7f42a3472dc2a1fe404058e1cf7051b3
MD5 d7f4751e0cee2d8120bdba38bac7c464
SHA1 43ed503448a0fedb606adf47fbcf28d3728ea295
SHA512 8ce087ccf119a806ea3b2b74414b94fea3540569e2c2abde8da88d4c94261f3060e2cd4cca9e82ec0a29f773d5c87e4d7ecaf616f51f867fdb0b700a69a9cdfc
SSDEEP 3072:whfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPvVaDAi:IJJtBYcpn/ez7pzkCi+Ai
MD5 SHA1 SHA512 SSDEEP

Submit Download

mbbvsulqzqv.b

Path C:\Users\Admin\AppData\Local\Temp\mbbvsulqzqv.b
Size 6KB
SHA256 7da267b212ae2364edfef0bc46938d00d6c064eb254b1f9958b88855c743470c
MD5 d5fe9811dad7b20b5bb21e67edb830e3
SHA1 7f1b64148fa63caed8aadefd98d01d031ac93e17
SHA512 59e67cd1df123df0ed45d133531f71c39fab1fdce687bc5f2f92bf9d2bbe51d06fff5e2e71c033ab27b7d09af79d9ce1e7561e8e5c695d4a8eeb51830d2c7c91
SSDEEP 96:Farc6oY1g/DrYuyk2XO5oSw0DjSkrbx7KiiiARqMtd/n5xXIf/3AVWmPX:FarcRtKhX1SJ/Sux7Kv8cdkvNmPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads