Analysis
-
max time kernel
129s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:15
Static task
static1
Behavioral task
behavioral1
Sample
baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exe
Resource
win10v2004-20220901-en
General
-
Target
baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exe
-
Size
24.9MB
-
MD5
debcc1f43abd7eeba8e7a4fe2c1d1529
-
SHA1
de328d0422a2b1fd3fd9290947bc562cdc0f6901
-
SHA256
baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52
-
SHA512
8fb0b19e0142a91f14ca495e87655af8af849f0f7e9effe50ce9e5db4bbdd7d51b5ecda786871403cbc64dce2d4c3827814d7d2ba18675bdf27d149ccde74023
-
SSDEEP
786432:ez/iijNAUnxHEjw2v0uLDDT0UK2VnvO4d:ebUCxHEjVvgUKgvO4d
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exepid process 1776 baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exe 1776 baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exe 1776 baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exepid process 1776 baddcd05feb42b0fe3a77e325c3b9875d8e0f8e81cb5e88cf663de9ac7208b52.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsy69AD.tmp\ButtonLinker.dllFilesize
7KB
MD5dd85ac7d85c92dd0e3cc17dfd4890f54
SHA1a128fb7a05965c1a9913c6f5e419e6c4c0a7d2fa
SHA25627abd2a4fb1bf66add60221b52d061bbe24d2d21e13600725ff7a5c6c777b504
SHA512e4ff8216c65110a9d156f37c2062acb53a72daa8af12dfc24278920d9e1a4083a81b1446759df75405b2da34c7bfb1afc33184feedd0aee4ed73f79fcbb1a8a1
-
\Users\Admin\AppData\Local\Temp\nsy69AD.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
\Users\Admin\AppData\Local\Temp\nsy69AD.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
memory/1776-54-0x0000000075F01000-0x0000000075F03000-memory.dmpFilesize
8KB