Analysis
-
max time kernel
295s -
max time network
346s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:04
Static task
static1
Behavioral task
behavioral1
Sample
f14b6c8707a9705a57d554847e414191738d67f53b572eb7cbd4bf45a0cf6676.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f14b6c8707a9705a57d554847e414191738d67f53b572eb7cbd4bf45a0cf6676.exe
Resource
win10v2004-20221111-en
General
-
Target
f14b6c8707a9705a57d554847e414191738d67f53b572eb7cbd4bf45a0cf6676.exe
-
Size
200KB
-
MD5
ad2d269de4b6e20e3c5f05530abb8bd8
-
SHA1
2fcfe67cd378160bb8ed4e3160ce80ccc08d6822
-
SHA256
f14b6c8707a9705a57d554847e414191738d67f53b572eb7cbd4bf45a0cf6676
-
SHA512
45d8ddfdea7adcb44377435d88bc0dd331798bb400f9e458bee58dbe3d7077430a2553e1f12ca102214527eded7c0516f024144414ec0c3abfde597a2503988a
-
SSDEEP
6144:TlzJH5O7SWi9UpSGusPmwMa87XGS/EocnzvWBU:/s51HPzmXGmzEvW2
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
f14b6c8707a9705a57d554847e414191738d67f53b572eb7cbd4bf45a0cf6676.exepid process 4040 f14b6c8707a9705a57d554847e414191738d67f53b572eb7cbd4bf45a0cf6676.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsyAE25.tmp\System.dllFilesize
11KB
MD5c6f5b9596db45ce43f14b64e0fbcf552
SHA1665a2207a643726602dc3e845e39435868dddabc
SHA2564b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0
SHA5128faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a