480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe
Size

19.3MB
MD5

4752e1d0ba5797a9c9f7bde631b48dcd
SHA1

835bc15cf32df9526c8d0fbfbe05ca1f6c386d1a
SHA256

480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6
SHA512

6147c874e5b9ec4326ba70c8fa74e9cfbafab1880f2698e7ab55c9cd051589e290865b1fd82bb9b001a388fc05c6bf352acfbed0206228350c5fdcaaf498245b
SSDEEP

393216:y5gfMnIdz+hfFKg28MqYpUedvlXNOyGVOtZZBXmVuy5NGBDga47q2rEcJdNJh5l9:y5gfMnIMhfd28Mq8Ue1UqZBXmVJNPB7X

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5004	is-95LU5.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 5004	2700	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	81
PID 2700 wrote to memory of 5004	2700	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	81
PID 2700 wrote to memory of 5004	2700	480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe	81

C:\Users\Admin\AppData\Local\Temp\480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe
"C:\Users\Admin\AppData\Local\Temp\480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\is-MAKS0.tmp\is-95LU5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MAKS0.tmp\is-95LU5.tmp" /SL4 $A0048 "C:\Users\Admin\AppData\Local\Temp\480ec91ab0ff3416f8df8d15b51a24bf402a6dbf0ebacee76017b7c5bad3aea6.exe" 19994724 51200
  2⤵
  - Executes dropped EXE
  PID:5004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-MAKS0.tmp\is-95LU5.tmp

Filesize
659KB

MD5
8d945b4b32cdbdae0b9e320e6870607f

SHA1
bc109a8a04450c4833449d56b5ad77d1e37fa063

SHA256
70a88b34f9a87419c8df27f097262e1bea0e7db7a8c27aa2376e311dc65de1b6

SHA512
7d59cbc9690c951f9e96e1af257f334affc38559f4d4a77ee4703ebd5a02a4424afa8fb1447775f5a02ab60ba3f49e84906bb8e2b3d44aabdfbdfb8938f0ef29

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MAKS0.tmp\is-95LU5.tmp

Filesize
659KB

MD5
8d945b4b32cdbdae0b9e320e6870607f

SHA1
bc109a8a04450c4833449d56b5ad77d1e37fa063

SHA256
70a88b34f9a87419c8df27f097262e1bea0e7db7a8c27aa2376e311dc65de1b6

SHA512
7d59cbc9690c951f9e96e1af257f334affc38559f4d4a77ee4703ebd5a02a4424afa8fb1447775f5a02ab60ba3f49e84906bb8e2b3d44aabdfbdfb8938f0ef29

Download Submit
memory/2700-132-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2700-137-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download