Overview

overview

7

Static

static

1

d5d3bac333...a3.exe

windows7-x64

7

d5d3bac333...a3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    185s
  • max time network
    216s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe

  • Size

    583KB

  • MD5

    512285753a25de92cdc3d1968d362cb2

  • SHA1

    718bfd424394c2e4b466e1ae1af6766b308a001b

  • SHA256

    d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3

  • SHA512

    dc9f5367062f68513eebdcd6db425b9bb474ec567bde83269c9d5a5c700f03f8793b38de33a6b2aeadcea7a239928722d6fe543eb544f204920b04e06314d211

  • SSDEEP

    12288:fGsb73aQW04PueNw5ALbtAOJIecgv0DHEnuK:fGsfao4mxmbtAOHcgvokn5

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe
    "C:\Users\Admin\AppData\Local\Temp\d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe"
    1⤵
    • Loads dropped DLL
    PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsa614B.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    eef9e469e8a30717974499f277d97e2a

    SHA1

    2d33c25984ebd9116beeb55cdde4c5c86c023e5d

    SHA256

    1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

    SHA512

    d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsa614B.tmp\StdUtils.dll
    Filesize

    18KB

    MD5

    e03876429de52398e49cf9b308ec97e2

    SHA1

    c540ca346d63666d40f7d64bec1fdc742ec9b7ae

    SHA256

    515f58aaad94e1a3c00577e258f9592f5e6eea32e0343392f4611852acf0f906

    SHA512

    c25ac014c77573af44d44f28ad547bd08f0c6f5b342d5d6269fcbd2dc92f8c2b859ea4091bec9c4e4ad8482b8951b03b526d4bfaddf8f802487d30348aaf627c

    Download Submit