Overview

overview

8

Static

static

1

698ec2389e...84.exe

windows7-x64

8

698ec2389e...84.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 21:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884.exe

  • Size

    614KB

  • MD5

    1e3f25d4d96c1b24c49ea04eb29d1c49

  • SHA1

    8ba18af7c275a34ef4b24a6a0acfe6720c62a833

  • SHA256

    698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884

  • SHA512

    ffae5e6cbff554dc228242c0d98408b88b5c90310d80df271ac4d2193d8066d0b4a8f3bde71ffd12ebb5eea59ac09c9cd01f0bd933de3562352de46b953dfe2f

  • SSDEEP

    12288:jCfnJXGT+2d7wfraS72bQDiF31ak8UVFS31Fj+y8R6NtZSPTu7:jOJBEcTaS72btjakVuGktg7u

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884.exe
    "C:\Users\Admin\AppData\Local\Temp\698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe
      "C:\Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1388

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe
    Filesize

    789KB

    MD5

    cac807502e0fc885f5a40374d5de03cb

    SHA1

    d1d945e2dcbf6c8a05b498d37d7a705a8f042773

    SHA256

    026d5b51aaf8f8886bf470f33e4ba26dfa23b305afb216c638dc8213a0399eec

    SHA512

    ba0a83caeba2395e616a8113dad1292f48e212a367352f492e4fd3388816709c51226a712befebbdef9e6dfd006f017ed54d4f89a313cf4a76ff0b070b39aa17

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe
    Filesize

    789KB

    MD5

    cac807502e0fc885f5a40374d5de03cb

    SHA1

    d1d945e2dcbf6c8a05b498d37d7a705a8f042773

    SHA256

    026d5b51aaf8f8886bf470f33e4ba26dfa23b305afb216c638dc8213a0399eec

    SHA512

    ba0a83caeba2395e616a8113dad1292f48e212a367352f492e4fd3388816709c51226a712befebbdef9e6dfd006f017ed54d4f89a313cf4a76ff0b070b39aa17

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsd6403.tmp\AdvSplash.dll
    Filesize

    6KB

    MD5

    a1bba35c752b36f575350cb7ddf238e4

    SHA1

    9603b691ae71d4fbc7a14dbb837bd97cecac8aab

    SHA256

    0667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6

    SHA512

    eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsd6403.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    254f13dfd61c5b7d2119eb2550491e1d

    SHA1

    5083f6804ee3475f3698ab9e68611b0128e22fd6

    SHA256

    fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

    SHA512

    fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    Download Submit
  • \Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe
    Filesize

    789KB

    MD5

    cac807502e0fc885f5a40374d5de03cb

    SHA1

    d1d945e2dcbf6c8a05b498d37d7a705a8f042773

    SHA256

    026d5b51aaf8f8886bf470f33e4ba26dfa23b305afb216c638dc8213a0399eec

    SHA512

    ba0a83caeba2395e616a8113dad1292f48e212a367352f492e4fd3388816709c51226a712befebbdef9e6dfd006f017ed54d4f89a313cf4a76ff0b070b39aa17

    Download Submit
  • \Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe
    Filesize

    789KB

    MD5

    cac807502e0fc885f5a40374d5de03cb

    SHA1

    d1d945e2dcbf6c8a05b498d37d7a705a8f042773

    SHA256

    026d5b51aaf8f8886bf470f33e4ba26dfa23b305afb216c638dc8213a0399eec

    SHA512

    ba0a83caeba2395e616a8113dad1292f48e212a367352f492e4fd3388816709c51226a712befebbdef9e6dfd006f017ed54d4f89a313cf4a76ff0b070b39aa17

    Download Submit
  • \Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe
    Filesize

    789KB

    MD5

    cac807502e0fc885f5a40374d5de03cb

    SHA1

    d1d945e2dcbf6c8a05b498d37d7a705a8f042773

    SHA256

    026d5b51aaf8f8886bf470f33e4ba26dfa23b305afb216c638dc8213a0399eec

    SHA512

    ba0a83caeba2395e616a8113dad1292f48e212a367352f492e4fd3388816709c51226a712befebbdef9e6dfd006f017ed54d4f89a313cf4a76ff0b070b39aa17

    Download Submit
  • memory/1388-58-0x0000000000000000-mapping.dmp
    Download
  • memory/1492-54-0x0000000075451000-0x0000000075453000-memory.dmp
    Filesize

    8KB

    Download