5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255.exe
Size

1.9MB
MD5

944ef779cfefc0727cbeb669aeb6cbdc
SHA1

d13d744ae712c3e00129b2464e957283d5a417c4
SHA256

5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255
SHA512

0bc0922327ac37cd0806cf5e97f9cd4ba2ca02b717748f1dd65766b8e657b362031e49777b7272790774dbbdf2cbf5c4e38822eb1299076f50c52255c548ad85
SSDEEP

49152:heDAVmqhptQukxX7OuxeqxphzL1D1qeeEyvVbT/WygUT/U:FtPmL0u8qPdN1CFbSygUT/U

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2376	is-3J98R.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2376	624	5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255.exe	85
PID 624 wrote to memory of 2376	624	5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255.exe	85
PID 624 wrote to memory of 2376	624	5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255.exe	85

C:\Users\Admin\AppData\Local\Temp\5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255.exe
"C:\Users\Admin\AppData\Local\Temp\5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\is-TOC06.tmp\is-3J98R.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TOC06.tmp\is-3J98R.tmp" /SL4 $80036 C:\Users\Admin\AppData\Local\Temp\5485554574c8963e433a48dc63c8fbe54d23faced2ec9136d4e03e9e88f0e255.exe 1764103 50688
  2⤵
  - Executes dropped EXE
  PID:2376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-TOC06.tmp\is-3J98R.tmp

Filesize
572KB

MD5
6c771e6862cef3b18328bf5b6241c991

SHA1
655632265be57089137ed53960800e8089e3ceb9

SHA256
701b05147a5f39aba879e3fe136f10ff1399dc4ca8d9f4bc23b4d05fa8065804

SHA512
aa9b52717127d2a6ea41d20cbb0952fd25ed5c65cdd9d6881f496b41cf0b7b1688034a9352a544a89987630e9324ed3bb351527aeddaad622031c84603556aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TOC06.tmp\is-3J98R.tmp

Filesize
572KB

MD5
6c771e6862cef3b18328bf5b6241c991

SHA1
655632265be57089137ed53960800e8089e3ceb9

SHA256
701b05147a5f39aba879e3fe136f10ff1399dc4ca8d9f4bc23b4d05fa8065804

SHA512
aa9b52717127d2a6ea41d20cbb0952fd25ed5c65cdd9d6881f496b41cf0b7b1688034a9352a544a89987630e9324ed3bb351527aeddaad622031c84603556aa2

Download Submit
memory/624-133-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/624-143-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2376-142-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2376-144-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2376-145-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download