77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69

Analysis

max time kernel
189s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69.exe
Size

6.9MB
MD5

7df849d36f3b99f182df5dc899a3fa32
SHA1

343b1cfce3369c1369cbf2ffa597f748c309db09
SHA256

77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69
SHA512

188592a18c6daace6b0e4b25888f6954b8de112654a68a252befcf87c9e19f52a7458d6954c0cdbb7d25c894b276311a1386b1885a7f8971592c8a8c932db153
SSDEEP

196608:pQFNk6LfP5t3iZQpncesJ4mcdeFdLAiqolsWoVsOau:pQzJVtyZQpns5cdeF+ifyb

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
384	77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69.exe
384	77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69.exe
384	77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69.exe
384	77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69.exe
"C:\Users\Admin\AppData\Local\Temp\77994542aa02ea75fc0c17d80ed424508ca7b2a2ed82e037d5b58aea2089bf69.exe"
1⤵
- Loads dropped DLL
PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg6255.tmp\ButtonLinker.dll

Filesize
7KB

MD5
dd85ac7d85c92dd0e3cc17dfd4890f54

SHA1
a128fb7a05965c1a9913c6f5e419e6c4c0a7d2fa

SHA256
27abd2a4fb1bf66add60221b52d061bbe24d2d21e13600725ff7a5c6c777b504

SHA512
e4ff8216c65110a9d156f37c2062acb53a72daa8af12dfc24278920d9e1a4083a81b1446759df75405b2da34c7bfb1afc33184feedd0aee4ed73f79fcbb1a8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg6255.tmp\ButtonLinker.dll

Filesize
7KB

MD5
dd85ac7d85c92dd0e3cc17dfd4890f54

SHA1
a128fb7a05965c1a9913c6f5e419e6c4c0a7d2fa

SHA256
27abd2a4fb1bf66add60221b52d061bbe24d2d21e13600725ff7a5c6c777b504

SHA512
e4ff8216c65110a9d156f37c2062acb53a72daa8af12dfc24278920d9e1a4083a81b1446759df75405b2da34c7bfb1afc33184feedd0aee4ed73f79fcbb1a8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg6255.tmp\System.dll

Filesize
10KB

MD5
2b54369538b0fb45e1bb9f49f71ce2db

SHA1
c20df42fda5854329e23826ba8f2015f506f7b92

SHA256
761dcdf12f41d119f49dbdca9bcab3928bbdfd8edd67e314d54689811f9d3e2f

SHA512
25e4898e3c082632dfd493756c4cc017decbef43ffa0b68f36d037841a33f2a1721f30314a85597ac30c7ecc99b7257ea43f3a903744179578a9c65fcf57a8b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg6255.tmp\System.dll

Filesize
10KB

MD5
2b54369538b0fb45e1bb9f49f71ce2db

SHA1
c20df42fda5854329e23826ba8f2015f506f7b92

SHA256
761dcdf12f41d119f49dbdca9bcab3928bbdfd8edd67e314d54689811f9d3e2f

SHA512
25e4898e3c082632dfd493756c4cc017decbef43ffa0b68f36d037841a33f2a1721f30314a85597ac30c7ecc99b7257ea43f3a903744179578a9c65fcf57a8b7

Download Submit