Overview

overview

7

Static

static

1

21395e63b5...1c.exe

windows7-x64

7

21395e63b5...1c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    23s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-10-2022 14:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21395e63b545e40fcec00a98481dd0a61ecbacd5956ab20b205370a1ec0ff11c.exe

  • Size

    742KB

  • MD5

    f408e12fb49b53a00dede0834f555cae

  • SHA1

    cf088a4209f867c84a035e257d9cae3064e7fbe4

  • SHA256

    21395e63b545e40fcec00a98481dd0a61ecbacd5956ab20b205370a1ec0ff11c

  • SHA512

    47303d1e724c3758d5cb242f530791b7774d112a8987b0d9bf8eb489d36da836a7ba3e65dbdacc6e87c49ecf7543bda19c48ced406ab2e94d3e792e2f1194111

  • SSDEEP

    12288:6/PS76V73pSMjLF+ZPPfnEUnsEWfXsNbjE3J8tauEZwFb6wZ7GOscpsXJ4SlA1KX:6/a+VrRMlvANcNc3J8EWpL+C+4SlA1KX

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\21395e63b545e40fcec00a98481dd0a61ecbacd5956ab20b205370a1ec0ff11c.exe
    "C:\Users\Admin\AppData\Local\Temp\21395e63b545e40fcec00a98481dd0a61ecbacd5956ab20b205370a1ec0ff11c.exe"
    1⤵
    • Loads dropped DLL
    PID:2032

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\IpConfig.dll
    Filesize

    114KB

    MD5

    a3ed6f7ea493b9644125d494fbf9a1e6

    SHA1

    ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8

    SHA256

    ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08

    SHA512

    7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\WmiInspector.dll
    Filesize

    104KB

    MD5

    8531346d16fa5d4768f6530d2eb2b65c

    SHA1

    153601d36aa0ddfbc597b1e890917364878791ca

    SHA256

    a9347413de4b0f90cac0b5e300cec9c867bdb28bd7a60d07b10fd31ee56c60cb

    SHA512

    f214e75de20edeb7eece02659fd7dafc8c3d63c2350c58825bc6e9ce0b73237962d8273b4bc803a2f304cee9f9cad1cd4edab28322c1e678bc25eb88faa6a841

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\WmiInspector.dll
    Filesize

    104KB

    MD5

    8531346d16fa5d4768f6530d2eb2b65c

    SHA1

    153601d36aa0ddfbc597b1e890917364878791ca

    SHA256

    a9347413de4b0f90cac0b5e300cec9c867bdb28bd7a60d07b10fd31ee56c60cb

    SHA512

    f214e75de20edeb7eece02659fd7dafc8c3d63c2350c58825bc6e9ce0b73237962d8273b4bc803a2f304cee9f9cad1cd4edab28322c1e678bc25eb88faa6a841

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsj40CB.tmp\inetc.dll
    Filesize

    20KB

    MD5

    f02155fa3e59a8fc48a74a236b2bb42e

    SHA1

    6d76ee8f86fb29f3352c9546250d940f1a476fb8

    SHA256

    096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    SHA512

    8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    Download Submit

  • memory/2032-54-0x0000000076031000-0x0000000076033000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2032-78-0x0000000003590000-0x00000000035AC000-memory.dmp

    Filesize

    112KB

    Download