c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2023, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe
Size

20.9MB
MD5

de6e256ef1dfd59a380b888b78dd8625
SHA1

9d34bc13c12e8f70253a0a7e31bb2b6dd720683d
SHA256

c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448
SHA512

a724f7f0da54eb12053b1f229a3eb0cafb51a494452e7cc124f00b5c1d75d2f9f38320d5733972d5b75c205c8ad941caebf11c3d016311370a8c8db43a3f7046
SSDEEP

393216:vnUytRlsrqgNlBoPZRjmquZEeqaml9NJ04riDBETwBsEKwT9hBr+D:vn58zbWRjmLSeba9P3iNMPwA

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe

Loads dropped DLL 3 IoCs

pid	Process
4988	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe
4988	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe
4988	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4988	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe
4988	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4988	4432	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe	83
PID 4432 wrote to memory of 4988	4432	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe	83
PID 4432 wrote to memory of 4988	4432	c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe	83

C:\Users\Admin\AppData\Local\Temp\c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe
"C:\Users\Admin\AppData\Local\Temp\c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\temp1\c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe
  "C:\Users\Admin\AppData\Local\Temp\temp1\c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe" /CUSTOMPARAM=C:\Users\Admin\AppData\Local\Temp\temp1\m-ipod-to-pc-transfer-for-win.exe_CUSTOMEDATA
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg7FA6.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7FA6.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7FA6.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7FA6.tmp\installmode.ini

Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe

Filesize
20.8MB

MD5
d7638ba0bf8effd0eb7b477356b95ea0

SHA1
92226f515d6e380f308d854445fb743174d9407b

SHA256
68b6612e5f9c15b5e58586cb3d82851969d4b1860faec08c4979b1dfa6609410

SHA512
1a2206a4482cb5b1759e6213d35707b8c926afba7180d62ea0971b3c6ef910fb64be8ecb5c94c8946e7c59709aca15d7fddf3593e11ad05dae074bdc6e08e95c

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\c05408bf80bae013af0fac2cd082530581ccf6da1befbc4c7a5344dcc5eb9448.exe

Filesize
20.8MB

MD5
d7638ba0bf8effd0eb7b477356b95ea0

SHA1
92226f515d6e380f308d854445fb743174d9407b

SHA256
68b6612e5f9c15b5e58586cb3d82851969d4b1860faec08c4979b1dfa6609410

SHA512
1a2206a4482cb5b1759e6213d35707b8c926afba7180d62ea0971b3c6ef910fb64be8ecb5c94c8946e7c59709aca15d7fddf3593e11ad05dae074bdc6e08e95c

Download Submit