6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
Size

4.6MB
MD5

e69ad5c182101e1283607356ec6e9439
SHA1

eb18b125139f40007f73649a64b7d9eec314dad2
SHA256

6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7
SHA512

00dd81594c0c013205d91acb8d3a5be3aa0b99c0a7fdfdf2a09acc492e1c5e3b2ff78c69c3955cede3dcb91e12d6d5576f619572f3803a67e7ce6eca123d2fdf
SSDEEP

98304:5PrdTlSXFDz2OfndF8pd6gQScuiG9mKui9ehA2kab:xplSpzXfdOMJqe+2kab

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

Processes:

6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe

pid	process
1476	6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
1476	6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
1476	6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
1476	6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
1476	6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
1476	6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
"C:\Users\Admin\AppData\Local\Temp\6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe"
1⤵
- Loads dropped DLL
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso43A7.tmp\BrandingURL.dll
Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
\Users\Admin\AppData\Local\Temp\nso43A7.tmp\NSISdl.dll
Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit
\Users\Admin\AppData\Local\Temp\nso43A7.tmp\SkinBtn.dll
Filesize
4KB

MD5
e4ec95271ff1bcebab49bdfed6817a22

SHA1
2c03e97f4773aea80ecdb98a1482e5896fe4677b

SHA256
ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6

SHA512
771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d

Download Submit
\Users\Admin\AppData\Local\Temp\nso43A7.tmp\System.dll
Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nso43A7.tmp\WndProc.dll
Filesize
3KB

MD5
f0cb331dd4bd92a6ebce45e7cd1cf5ef

SHA1
b66ea0c10b08750295f2dc7c170b370402393214

SHA256
e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458

SHA512
7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271

Download Submit
\Users\Admin\AppData\Local\Temp\nso43A7.tmp\nsDialogs.dll
Filesize
9KB

MD5
ab73c0c2a23f913eabdc4cb24b75cbad

SHA1
6569d2863d54c88dcf57c843fc310f6d9571a41e

SHA256
3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457

SHA512
99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8

Download Submit
memory/1476-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download