1875b7fa5fb3b439c6761a821b5b6c3fc060ba2010578e84736c2cd58585abe9

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/09/2022, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Urgent offer Hopkirk Battery Systems (Liyang) Co. 30_9_2022.exe
Size 485KB
Sample220930-k3a3dsdba6
SHA256 1875b7fa5fb3b439c6761a821b5b6c3fc060ba2010578e84736c2cd58585abe9
MD5 5d76fe97dd199e4c37040abaa7e67220
SHA1 ec4127572fe5efb8e7ba95dc17e6eb7b2fd6a872
SHA512 4c1cf389da6ad9856f4dddcd0c0cd8c2ad73369793f218c20a4c07df5ef75452ff860adb5ad419255992b37048e754ba3ed85bb94e114dc7d95eb122fd219bf8
SSDEEP 12288:5OMttaxM+55i30viQ6p20gfUsKG9dzHEnUqciJx8kY8I:Y2EMeW0v16g0XkeJbI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1604	Urgent offer Hopkirk Battery Systems (Liyang) Co. 30_9_2022.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Urgent offer Hopkirk Battery Systems (Liyang) Co. 30_9_2022.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent offer Hopkirk Battery Systems (Liyang) Co. 30_9_2022.exe"
1⤵
- Loads dropped DLL
PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nse3CF3.tmp\System.dll
Size 11KB
SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
MD5 9625d5b1754bc4ff29281d415d27a0fd
SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1604-54-0x0000000075601000-0x0000000075603000-memory.dmp

Download