Analysis
-
max time kernel
304s -
max time network
317s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:08
Static task
static1
Behavioral task
behavioral1
Sample
e9558ab1bd34dd3e7657017db3cd803904de313eeb93662fc91bcc33d5fa9442.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e9558ab1bd34dd3e7657017db3cd803904de313eeb93662fc91bcc33d5fa9442.exe
Resource
win10v2004-20221111-en
General
-
Target
e9558ab1bd34dd3e7657017db3cd803904de313eeb93662fc91bcc33d5fa9442.exe
-
Size
603KB
-
MD5
54abfea76e6463c6574f1b1d4bd895ac
-
SHA1
0d6100d580049cb5f816f98c9262ae76d10af23c
-
SHA256
e9558ab1bd34dd3e7657017db3cd803904de313eeb93662fc91bcc33d5fa9442
-
SHA512
5ae75ad5c5a94ea1844b65a5cd227062762378c550e827b461336c0cfc8fab609b0e21927af513cac720691b2cef63bf41c1ac896f6f8d2f598e7a204a4f7675
-
SSDEEP
12288:aIny5DYTfIhf78EZnQV7Mx4Q2iXi8CPIlCbUpiV/I:8UTfeAEtsAl3w
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
e9558ab1bd34dd3e7657017db3cd803904de313eeb93662fc91bcc33d5fa9442.exepid process 4524 e9558ab1bd34dd3e7657017db3cd803904de313eeb93662fc91bcc33d5fa9442.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsvD3D.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
memory/4524-132-0x0000000000360000-0x00000000007BE000-memory.dmpFilesize
4.4MB