Overview

overview

7

Static

static

d2df0f3210...ae.exe

windows7-x64

7

d2df0f3210...ae.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    43s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d2df0f3210d477ae443a8e6e4c76ce82d3898403a20ab28764fb03da087829ae.exe

  • Size

    154KB

  • MD5

    e9a1ac2142e4d84df0869b89730da476

  • SHA1

    a0a26350fb4aa34971107183972eac149ce72e3b

  • SHA256

    d2df0f3210d477ae443a8e6e4c76ce82d3898403a20ab28764fb03da087829ae

  • SHA512

    aa24c495a08fbff26eee14a44f769d6a5af4244e918e0988ecc94071a35bee3390d281e5e3ae3da1474963f5344895aaf0c424d7b6021e2f84fb7765c5ab27c0

  • SSDEEP

    3072:ujnBTi2CRDZYzIq3+qlr1+ZNEo3HoHQMw32k:Ihi2CEZ3/Y5HJ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2df0f3210d477ae443a8e6e4c76ce82d3898403a20ab28764fb03da087829ae.exe
    "C:\Users\Admin\AppData\Local\Temp\d2df0f3210d477ae443a8e6e4c76ce82d3898403a20ab28764fb03da087829ae.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsiA3F.tmp\FindProcDLL.dll
    Filesize

    27KB

    MD5

    6f73b00aef6c49eac62128ef3eca677e

    SHA1

    1b6aff67d570e5ee61af2376247590eb49b728a1

    SHA256

    6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

    SHA512

    678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsiA3F.tmp\inetc.dll
    Filesize

    24KB

    MD5

    1fc1fbb2c7a14b7901fc9abbd6dbef10

    SHA1

    4d9ed86f31075a3d3f674ff78f39c190a4098126

    SHA256

    4f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e

    SHA512

    76d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsiA3F.tmp\nsExec.dll
    Filesize

    6KB

    MD5

    1128ee61dffa0a97d30b2f828235b289

    SHA1

    b552f3d4f13894f2f30fb446893093ca78fe149c

    SHA256

    1e33decac84bdd2b3a651c969258f8e6c90616e9ec35de6ab4f402709555ce4c

    SHA512

    d470356be436997fc53c17b8546cc80b187538ad2f258788761b92c28d91ef733fe6d8b3b33c353d84d1e0ae089207efd1ebfde33a6d33d5a341960e7bcfc8f5

    Download Submit
  • memory/740-54-0x0000000075A81000-0x0000000075A83000-memory.dmp
    Filesize

    8KB

    Download