7e888d65d20a6ecc59083c7ef9236f4cf74ed8dc96a54f69989ad52d24b54681

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:38

Target

MV VALADON.exe
Size

316KB
MD5

a7997ce482de4f44a8790ffbc8d6f981
SHA1

5d62e50c3c831f88deef4a6945721917172ab544
SHA256

7e888d65d20a6ecc59083c7ef9236f4cf74ed8dc96a54f69989ad52d24b54681
SHA512

0df5ffbf0d72f749f31b2c1256367425023f109079319fe79bb960062e90439057cf492db242374f25bb7272382d6c043a58c29dd88731237c2aec9a888437c1
SSDEEP

6144:slJZf/SvjIg4YXs99UNKfSOvPyXVxGgIidmrL29RG60umJaDUbaPZx9Yx2:slivjIBaWmKlyXVxGtiQig60uAkvx44

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

Processes:

MV VALADON.exe

pid process

1552 MV VALADON.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Program Files directory 1 IoCs

Processes:

MV VALADON.exe

description ioc process

File opened for modification C:\Program Files (x86)\Lokalplanomraades166\Korruptionerne\Dyrkning\Fatalister.ini MV VALADON.exe

pid	process
1552	MV VALADON.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Lokalplanomraades166\Korruptionerne\Dyrkning\Fatalister.ini	MV VALADON.exe

Drops file in Windows directory 2 IoCs

Processes:

MV VALADON.exe

description	ioc	process
File opened for modification	C:\Windows\Inconstancies.Mom	MV VALADON.exe
File opened for modification	C:\Windows\resources\0409\Xystum247\Kredittimes\Beramme.Ery	MV VALADON.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsy2DF6.tmp\System.dll

Filesize
11KB

MD5
fc90dfb694d0e17b013d6f818bce41b0

SHA1
3243969886d640af3bfa442728b9f0dff9d5f5b0

SHA256
7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

SHA512
324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

Download Submit
memory/1552-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1552-56-0x0000000002220000-0x000000000237C000-memory.dmp

Filesize
1.4MB

Download