8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113

Analysis

max time kernel
47s
max time network
50s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
25-10-2022 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113.exe
Size

342KB
MD5

12799970ad1664a55da70a4897f24871
SHA1

5b04b65bd300124b7a9f0da2d5bbcb18d4e6e4fd
SHA256

8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113
SHA512

bf9d17a176c13a116714d575f191eaf902e882bfc50bc3e74e85ac1b97125a9f7280f6b37f6f37c87470d5c618abe7caf8308b1b718494224417a2567505feaa
SSDEEP

6144:PtZysKzYlt+Dgs9uwFyG1h62Z1MqQCjziNgyk2:Cs4ot+ksh1h6Q1MqQR2yf

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2860	8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Sebiferous\Snapsetingets\Comparisons.For	8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113.exe
File opened for modification	C:\Program Files (x86)\Common Files\Styrtdykkenes\Koumys\Overfladearealet94\Skalatrinnenes.ini	8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Kali\Fictional\velbekendtes\Subpellucid.Tra23	8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113.exe
"C:\Users\Admin\AppData\Local\Temp\8167beaf27ed4c8ec02e74cbd8dff7526063e0f69aab33fb276e100895b86113.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nswCB45.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
memory/2860-120-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-121-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-122-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-123-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-124-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-125-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-126-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-127-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-128-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-130-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-129-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-131-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-132-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-133-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-134-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-135-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-136-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-137-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-138-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-139-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-140-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-141-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-142-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-143-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-144-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-146-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-148-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-149-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-150-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-147-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-145-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-151-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-152-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-153-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-154-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-155-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-156-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-157-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-158-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-159-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-160-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-161-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-162-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-163-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-164-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-165-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-166-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-167-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-168-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-169-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-170-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-171-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-172-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-174-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-175-0x0000000002910000-0x00000000029E1000-memory.dmp

Filesize
836KB

Download
memory/2860-176-0x0000000077320000-0x00000000774AE000-memory.dmp

Filesize
1.6MB

Download
memory/2860-177-0x0000000002910000-0x00000000029E1000-memory.dmp

Filesize
836KB

Download