b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f | Triage

Analysis

max time kernel
41s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe
Size

98KB
MD5

88766e5da236b7f682383af382a2fc4a
SHA1

fc041fbc1a267077bede4d582bf839b3a017bedc
SHA256

b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f
SHA512

3ce6830ca1db67375e7b547235a3a6ac47721c599a0cdca3c653a8b76b7b159b9e7ddd968673ed1e67e2e7f50149f7bc375062160bf52499d88cee4a684c9207
SSDEEP

1536:zQpQ5EP0ijnRTXJBwpIu9MEddtBpwED+qGXgHkXxlJTqD9UfOv8/xdv3:zQIURTXJBoddtBpwWGXgEhlFk8/xdP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe
"C:\Users\Admin\AppData\Local\Temp\b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe"
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsgB008.tmp\Registry.dll

Filesize
18KB

MD5
024a7fbff8d94dbd176d652e524e838d

SHA1
4af9ec6bcf69856def724fd6040cbf6e9c1e67a2

SHA256
90946fba849c02b74d54a5849aad4ad94cc60093edbdfd1babc3799827c462fd

SHA512
4b0a27689fd7a3d164f2410a4661b9e5e72f17b42a2ad2d7dae102bc4413c06bc84f395ada429d68db96bbd1499b57b660e4e31e4ab6325934acb8677dafe276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgB008.tmp\Registry.dll

Filesize
14KB

MD5
2da4efacb15a0878de35b23d4034e1b8

SHA1
0e8b74d59df3429389e1f67760049740573195cd

SHA256
127dd145890fa48f65389447fe3723e0193e87f88f37b8d2de22403e938d3dc5

SHA512
d5c0e44f14861bf243f83fff739e1a0e7401ca46d82d4b007c2751367fc5c141c07f182b151f87168bfbfbf0536dc8c20f3ab0fb9a4f6e1bc00ed597e24748aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgB008.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/2064-135-0x0000000003000000-0x0000000003059000-memory.dmp

Filesize
356KB

Download