Overview

overview

7

Static

static

2a249ba402...2d.exe

windows7-x64

7

2a249ba402...2d.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe

  • Size

    154KB

  • MD5

    63f87118614701fb0b24a468cabec725

  • SHA1

    617ef93b047de0c19d0f5959da008eae44e0e54c

  • SHA256

    2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d

  • SHA512

    d74170f844649671b075ed87c854e75014219fc72313b5cccd8c44c1047526ccdfc71037db66ef8d1c8f866d57650b760a1888f7941187deeb703cbcd066977c

  • SSDEEP

    3072:ujnBTi2CRDZYzIq3+Zlr1+ZNEo3HoHQMw32k:Ihi2CEZ3cY5HJ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe
    "C:\Users\Admin\AppData\Local\Temp\2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:2284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsjDEFC.tmp\FindProcDLL.dll
    Filesize

    27KB

    MD5

    6f73b00aef6c49eac62128ef3eca677e

    SHA1

    1b6aff67d570e5ee61af2376247590eb49b728a1

    SHA256

    6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

    SHA512

    678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsjDEFC.tmp\inetc.dll
    Filesize

    24KB

    MD5

    1fc1fbb2c7a14b7901fc9abbd6dbef10

    SHA1

    4d9ed86f31075a3d3f674ff78f39c190a4098126

    SHA256

    4f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e

    SHA512

    76d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsjDEFC.tmp\nsExec.dll
    Filesize

    6KB

    MD5

    1128ee61dffa0a97d30b2f828235b289

    SHA1

    b552f3d4f13894f2f30fb446893093ca78fe149c

    SHA256

    1e33decac84bdd2b3a651c969258f8e6c90616e9ec35de6ab4f402709555ce4c

    SHA512

    d470356be436997fc53c17b8546cc80b187538ad2f258788761b92c28d91ef733fe6d8b3b33c353d84d1e0ae089207efd1ebfde33a6d33d5a341960e7bcfc8f5

    Download Submit