b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2023, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe
Size

29.4MB
MD5

87fe29669773872602c9c6bd3cd8caef
SHA1

a6c37414755b6eda059998ef67000d315148d92a
SHA256

b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735
SHA512

6a2eba17a54583cbdb06baefe8fb0d2214ede0b45a1b7654f56c24c3fd09c793b219c7804a133939e0798cb31d509d27186cdf353c1ea7f54415e12339a12746
SSDEEP

786432:vIj6wmR9ivrdiVFG6Njp2R4YeAOWLLUjeK4F8tsWZ2yh:vImwgivMnNjpo4aO4UjKF8u2h

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3920	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe

Loads dropped DLL 3 IoCs

pid	Process
3920	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe
3920	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe
3920	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe
3920	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 3920	3648	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe	85
PID 3648 wrote to memory of 3920	3648	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe	85
PID 3648 wrote to memory of 3920	3648	b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe	85

C:\Users\Admin\AppData\Local\Temp\b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe
"C:\Users\Admin\AppData\Local\Temp\b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\temp1\b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe
  "C:\Users\Admin\AppData\Local\Temp\temp1\b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe" /CUSTOMPARAM=C:\Users\Admin\AppData\Local\Temp\temp1\mvc-zune-converter.exe_CUSTOMEDATA
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE4F.tmp\installmode.ini

Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe

Filesize
29.3MB

MD5
fb326b3ba455c35482db9e421d1ee5ed

SHA1
cc8a421ded14a41d65e46ca76068133d0ce118b2

SHA256
098856efd26b0152fbd2c53828e20f80e437ac53c8a9e91e9deeeb7dd8a2830e

SHA512
42a79c19e1cee96bdb4adc963f03b58adffb79d9a895a99d3259663df0a53aea7f4215f4bf147d0c51c2ff66503769cf255a65e1d86b62e5e5dd144b324dbaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\b1c778370b398c6293b46cfc327fdb2333b288d69308975bf1f5cab79a781735.exe

Filesize
29.3MB

MD5
fb326b3ba455c35482db9e421d1ee5ed

SHA1
cc8a421ded14a41d65e46ca76068133d0ce118b2

SHA256
098856efd26b0152fbd2c53828e20f80e437ac53c8a9e91e9deeeb7dd8a2830e

SHA512
42a79c19e1cee96bdb4adc963f03b58adffb79d9a895a99d3259663df0a53aea7f4215f4bf147d0c51c2ff66503769cf255a65e1d86b62e5e5dd144b324dbaf6

Download Submit