Analysis
-
max time kernel
53s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2023 04:25
Static task
static1
Behavioral task
behavioral1
Sample
36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe
Resource
win10v2004-20230220-en
General
-
Target
36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe
-
Size
3.0MB
-
MD5
dd60ed970e7b840688eaa33901d23a2a
-
SHA1
d1bbbba77ee88789ba026737e6fd2300e1c230ab
-
SHA256
36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa
-
SHA512
428b793b5a6c1697ba0883581122eb480353aef349ad03733ed2e7fdcecfc3c0ee87565714c45c678a2d4e0659ebd93d84480294301153b8656fe61f9336a069
-
SSDEEP
49152:WH5lTSK1Rxg5hywNnYuqu3VTAhBfNkwtUuxqE3TKcrGzKEEIhf31jLa:WH5ZN1RxwEAnYJKqfN5tUuxOK8313a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 2064 Au_.exe -
Loads dropped DLL 2 IoCs
Processes:
Au_.exepid process 2064 Au_.exe 2064 Au_.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Au_.exedescription ioc process File opened for modification \??\PhysicalDrive0 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Au_.exepid process 2064 Au_.exe 2064 Au_.exe 2064 Au_.exe 2064 Au_.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Au_.exepid process 2064 Au_.exe 2064 Au_.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exedescription pid process target process PID 4616 wrote to memory of 2064 4616 36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe Au_.exe PID 4616 wrote to memory of 2064 4616 36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe Au_.exe PID 4616 wrote to memory of 2064 4616 36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe Au_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe"C:\Users\Admin\AppData\Local\Temp\36a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsiD017.tmp\System.dllFilesize
22KB
MD5a321954c01a0fe650a9f73975243e22f
SHA1cbdaadb3f5183a50cfba66be70249f54d6dfda57
SHA2565e3cabdfdffbaaf3a43c9b8fb8eeae99f818ff9f8c0a9ab7c516b9393fa552de
SHA512cdc5a3c270da0717c301492581687685bd2d7399d4166371d74886722009f6a8e93670c631230ae6fa35121c049ca38d94b27d5e52d6d95cda68fc6d0ba229a7
-
C:\Users\Admin\AppData\Local\Temp\nsiD017.tmp\insthelper.dllFilesize
2.7MB
MD5a6ecb533bd7515d38307ad73f3f51c18
SHA15fcc54d06e45a071184f83ccb94d6c8e0f051496
SHA256c0c0f5e092c858144697d24670e7d6636a8dbe2e5d38655cd5726d0f9e5229ff
SHA51217883811bd107f766ca3a911232bf04316bdbbd365223295054fb89ecb78197feaceb3f5cc27baa3e87140db73f03d36b5175b5001bb39fc49577c68c0156d93
-
C:\Users\Admin\AppData\Local\Temp\nsiD017.tmp\insthelper.dllFilesize
2.7MB
MD5a6ecb533bd7515d38307ad73f3f51c18
SHA15fcc54d06e45a071184f83ccb94d6c8e0f051496
SHA256c0c0f5e092c858144697d24670e7d6636a8dbe2e5d38655cd5726d0f9e5229ff
SHA51217883811bd107f766ca3a911232bf04316bdbbd365223295054fb89ecb78197feaceb3f5cc27baa3e87140db73f03d36b5175b5001bb39fc49577c68c0156d93
-
C:\Users\Admin\AppData\Local\Temp\nsiD017.tmp\res\skin\btn_close.pngFilesize
1KB
MD5d6d22365523a1dd214388b5335366ae4
SHA18a0f196a3a728bef47a3aeb07cff55259d76aba5
SHA256141a2c83dd24e39b9f9e15e30b9a6bc860aeb36ed42e945ab35107c9f75ea285
SHA512f606065c3f8b61398820de73d8d6b0e803be321e6859af25037eabe68f01a34c894e0809f785426d2f9e6c8246e9fc2aef34190b9f9e122acc2cef3c99f46168
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeFilesize
3.0MB
MD5dd60ed970e7b840688eaa33901d23a2a
SHA1d1bbbba77ee88789ba026737e6fd2300e1c230ab
SHA25636a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa
SHA512428b793b5a6c1697ba0883581122eb480353aef349ad03733ed2e7fdcecfc3c0ee87565714c45c678a2d4e0659ebd93d84480294301153b8656fe61f9336a069
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeFilesize
3.0MB
MD5dd60ed970e7b840688eaa33901d23a2a
SHA1d1bbbba77ee88789ba026737e6fd2300e1c230ab
SHA25636a2c605f21c340257c07271d7e710014b96cad761bd4e68e69dc467eced5eaa
SHA512428b793b5a6c1697ba0883581122eb480353aef349ad03733ed2e7fdcecfc3c0ee87565714c45c678a2d4e0659ebd93d84480294301153b8656fe61f9336a069