Analysis
-
max time kernel
105s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:33
Static task
static1
Behavioral task
behavioral1
Sample
3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe
Resource
win10v2004-20220901-en
General
-
Target
3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe
-
Size
155KB
-
MD5
cc6321d7f6388eee0b11edf313efdbb1
-
SHA1
71d70758d6e6e0b751c4109aa51db1a2be38e710
-
SHA256
3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05
-
SHA512
56ae9bfb8165bbfdfa25288ea46ad2f18c73ed0383afcebf6454d201965b7e329021c18332bea3d99de00478cbd124c76d24959a44c5ec59c37ea4370689efb3
-
SSDEEP
3072:ujnBTi2CRDZYzIq0Vy0r1+ZNEo3HoHQMw32k:Ihi2CEZ0zY5HJ
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exepid process 2324 3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe 2324 3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe 2324 3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exepid process 2324 3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe 2324 3b3689d5590cba17d4ced749243596bcc8e0caea9cfb7da4c2febbfbe615da05.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsbD900.tmp\FindProcDLL.dllFilesize
27KB
MD56f73b00aef6c49eac62128ef3eca677e
SHA11b6aff67d570e5ee61af2376247590eb49b728a1
SHA2566eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
SHA512678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
-
C:\Users\Admin\AppData\Local\Temp\nsbD900.tmp\inetc.dllFilesize
24KB
MD51fc1fbb2c7a14b7901fc9abbd6dbef10
SHA14d9ed86f31075a3d3f674ff78f39c190a4098126
SHA2564f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e
SHA51276d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2
-
C:\Users\Admin\AppData\Local\Temp\nsbD900.tmp\nsExec.dllFilesize
6KB
MD51128ee61dffa0a97d30b2f828235b289
SHA1b552f3d4f13894f2f30fb446893093ca78fe149c
SHA2561e33decac84bdd2b3a651c969258f8e6c90616e9ec35de6ab4f402709555ce4c
SHA512d470356be436997fc53c17b8546cc80b187538ad2f258788761b92c28d91ef733fe6d8b3b33c353d84d1e0ae089207efd1ebfde33a6d33d5a341960e7bcfc8f5