Overview

overview

7

Static

static

3b3689d559...05.exe

windows7-x64

7

3b3689d559...05.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 12:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe

  • Size

    155KB

  • MD5

    cc6321d7f6388eee0b11edf313efdbb1

  • SHA1

    71d70758d6e6e0b751c4109aa51db1a2be38e710

  • SHA256

    3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05

  • SHA512

    56ae9bfb8165bbfdfa25288ea46ad2f18c73ed0383afcebf6454d201965b7e329021c18332bea3d99de00478cbd124c76d24959a44c5ec59c37ea4370689efb3

  • SSDEEP

    3072:ujnBTi2CRDZYzIq0Vy0r1+ZNEo3HoHQMw32k:Ihi2CEZ0zY5HJ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe
    "C:\Users\Admin\AppData\Local\Temp\3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:868

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsi1315.tmp\FindProcDLL.dll
    Filesize

    27KB

    MD5

    6f73b00aef6c49eac62128ef3eca677e

    SHA1

    1b6aff67d570e5ee61af2376247590eb49b728a1

    SHA256

    6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

    SHA512

    678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsi1315.tmp\inetc.dll
    Filesize

    24KB

    MD5

    1fc1fbb2c7a14b7901fc9abbd6dbef10

    SHA1

    4d9ed86f31075a3d3f674ff78f39c190a4098126

    SHA256

    4f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e

    SHA512

    76d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsi1315.tmp\nsExec.dll
    Filesize

    6KB

    MD5

    1128ee61dffa0a97d30b2f828235b289

    SHA1

    b552f3d4f13894f2f30fb446893093ca78fe149c

    SHA256

    1e33decac84bdd2b3a651c969258f8e6c90616e9ec35de6ab4f402709555ce4c

    SHA512

    d470356be436997fc53c17b8546cc80b187538ad2f258788761b92c28d91ef733fe6d8b3b33c353d84d1e0ae089207efd1ebfde33a6d33d5a341960e7bcfc8f5

    Download Submit
  • memory/868-54-0x0000000075131000-0x0000000075133000-memory.dmp
    Filesize

    8KB

    Download