Overview

overview

7

Static

static

b76a92b0b5...8c.exe

windows7-x64

7

b76a92b0b5...8c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2022 13:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b76a92b0b504e6fb041ce16ed14997d6855333c42d0c97500c11e6db1318818c.exe

  • Size

    19.7MB

  • MD5

    ebce0677b99dece73c8ff532ba269aa2

  • SHA1

    d1d2447e194e9c002bc0abd0be2c561f890d20f9

  • SHA256

    b76a92b0b504e6fb041ce16ed14997d6855333c42d0c97500c11e6db1318818c

  • SHA512

    c34aee15628d13efd7ac61ea3d493ba624d1ebaddaff76ec7755e36c2ee399ddbfce57c273ccb24b61dcb1e3418b817b28f1d611d5cdbf9de91de0127b6e686b

  • SSDEEP

    393216:znU9zj+S6zSOeWcELT/Xx/Ez+B2T+VdzHvy0aOe02ytRdXluBp6XvnaKVz18+EK:zU9XJ+SXWBLTPuzy2SVdT6702CbluH6X

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b76a92b0b504e6fb041ce16ed14997d6855333c42d0c97500c11e6db1318818c.exe
    "C:\Users\Admin\AppData\Local\Temp\b76a92b0b504e6fb041ce16ed14997d6855333c42d0c97500c11e6db1318818c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:4228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\FindProcDLL.dll
    Filesize

    27KB

    MD5

    6f73b00aef6c49eac62128ef3eca677e

    SHA1

    1b6aff67d570e5ee61af2376247590eb49b728a1

    SHA256

    6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

    SHA512

    678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\FindProcDLL.dll
    Filesize

    27KB

    MD5

    6f73b00aef6c49eac62128ef3eca677e

    SHA1

    1b6aff67d570e5ee61af2376247590eb49b728a1

    SHA256

    6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

    SHA512

    678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\System.dll
    Filesize

    11KB

    MD5

    7399323923e3946fe9140132ac388132

    SHA1

    728257d06c452449b1241769b459f091aabcffc5

    SHA256

    5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

    SHA512

    d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9419.tmp\nsDialogs.dll
    Filesize

    325KB

    MD5

    14a2baa31f6641f9228a74d5db18fb96

    SHA1

    b4b1c38f09efc2b74b4cd8fd5cd28e6b11dffbd6

    SHA256

    5491b53f9286a0a62140080eed9fb1d0d70c09a29039b1b841b8aff2134623fa

    SHA512

    61d0867d925e141f0ed9866d3613a02ca891880843e87c40e3f8edb289569fc17850c0b81d0a27d02c714e66bf0e178b2753b38db09d8f3f0669470f9f43e4a3

    Download Submit

  • memory/4228-137-0x00000000039E0000-0x00000000039EA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4228-141-0x00000000039E0000-0x0000000003A38000-memory.dmp

    Filesize

    352KB

    Download

  • memory/4228-140-0x00000000039E1000-0x0000000003A1F000-memory.dmp

    Filesize

    248KB

    Download