5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6

Analysis

max time kernel
68s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe
Size

62KB
MD5

7b88880af17906f12755c75f8cc4d8ce
SHA1

777adb3e82c799a019726d6bbfc2052837615b65
SHA256

5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6
SHA512

0cb15a93a3264a7b42f773673db3f0255a4390a45c7e945d4a84caec868eec096791ab1c07b48179a00d6a5639bf57ddbd0044957f09ff9535dee5653e91ca63
SSDEEP

1536:H6gjYCnXsALqoP/k0PnW/PC2Zun0O7NmiM8Q5:HldTqoP/BPngPC2sX7q

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1348	5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe
1348	5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe
1348	5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe
1348	5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe
1348	5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe
"C:\Users\Admin\AppData\Local\Temp\5a6ceb8f4609b04f58052d085b21f6c06db026d0d74679a5b44909c3cb6c82b6.exe"
1⤵
- Loads dropped DLL
PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso7726.tmp\inetc.dll

Filesize
31KB

MD5
5da9df435ff20853a2c45026e7681cef

SHA1
39b1d70a7a03e7c791cb21a53d82fd949706a4b4

SHA256
9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

SHA512
4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

Download Submit
\Users\Admin\AppData\Local\Temp\nso7726.tmp\inetc.dll

Filesize
31KB

MD5
5da9df435ff20853a2c45026e7681cef

SHA1
39b1d70a7a03e7c791cb21a53d82fd949706a4b4

SHA256
9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

SHA512
4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

Download Submit
\Users\Admin\AppData\Local\Temp\nso7726.tmp\inetc.dll

Filesize
31KB

MD5
5da9df435ff20853a2c45026e7681cef

SHA1
39b1d70a7a03e7c791cb21a53d82fd949706a4b4

SHA256
9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

SHA512
4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

Download Submit
\Users\Admin\AppData\Local\Temp\nso7726.tmp\inetc.dll

Filesize
31KB

MD5
5da9df435ff20853a2c45026e7681cef

SHA1
39b1d70a7a03e7c791cb21a53d82fd949706a4b4

SHA256
9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

SHA512
4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

Download Submit
\Users\Admin\AppData\Local\Temp\nso7726.tmp\inetc.dll

Filesize
31KB

MD5
5da9df435ff20853a2c45026e7681cef

SHA1
39b1d70a7a03e7c791cb21a53d82fd949706a4b4

SHA256
9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

SHA512
4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

Download Submit
memory/1348-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download