3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311 | Triage

Analysis

max time kernel
1783s
max time network
1592s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-06-2022 16:12

Sharing

Report Analysis Logs

General

Target

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
Size

251KB
MD5

3b522c3e3fc6cf29a2c8c65a80f14a08
SHA1

91d0554ae2d347a98a695b4ee9aea4061794bb38
SHA256

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311
SHA512

a1dba2dd77ae3637b0809aece3ffb8827e21498d3127b56d6390ced34444ccf10c56a2741b4c52cf53efa5ab0dcdcfc52e68561322dab74d975e9e15b6d545aa

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

pid process

3468 3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
"C:\Users\Admin\AppData\Local\Temp\3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe"
1⤵
- Loads dropped DLL
PID:3468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi5CEB.tmp\System.dll
Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit