Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 08:07
Static task
static1
Behavioral task
behavioral1
Sample
6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
Resource
win10v2004-20220901-en
General
-
Target
6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe
-
Size
4.6MB
-
MD5
e69ad5c182101e1283607356ec6e9439
-
SHA1
eb18b125139f40007f73649a64b7d9eec314dad2
-
SHA256
6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7
-
SHA512
00dd81594c0c013205d91acb8d3a5be3aa0b99c0a7fdfdf2a09acc492e1c5e3b2ff78c69c3955cede3dcb91e12d6d5576f619572f3803a67e7ce6eca123d2fdf
-
SSDEEP
98304:5PrdTlSXFDz2OfndF8pd6gQScuiG9mKui9ehA2kab:xplSpzXfdOMJqe+2kab
Malware Config
Signatures
-
Loads dropped DLL 11 IoCs
Processes:
6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exepid process 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe 5012 6652a597cbde2ad006eadff320cab1a265ba620c472d62e47f02ce5520cdffb7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\BrandingURL.dllFilesize
4KB
MD571c46b663baa92ad941388d082af97e7
SHA15a9fcce065366a526d75cc5ded9aade7cadd6421
SHA256bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
SHA5125965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\BrandingURL.dllFilesize
4KB
MD571c46b663baa92ad941388d082af97e7
SHA15a9fcce065366a526d75cc5ded9aade7cadd6421
SHA256bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
SHA5125965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\NSISdl.dllFilesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\NSISdl.dllFilesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\SkinBtn.dllFilesize
4KB
MD5e4ec95271ff1bcebab49bdfed6817a22
SHA12c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA256ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
SHA512771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\SkinBtn.dllFilesize
4KB
MD5e4ec95271ff1bcebab49bdfed6817a22
SHA12c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA256ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
SHA512771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\WndProc.dllFilesize
3KB
MD5f0cb331dd4bd92a6ebce45e7cd1cf5ef
SHA1b66ea0c10b08750295f2dc7c170b370402393214
SHA256e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
SHA5127c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\WndProc.dllFilesize
3KB
MD5f0cb331dd4bd92a6ebce45e7cd1cf5ef
SHA1b66ea0c10b08750295f2dc7c170b370402393214
SHA256e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
SHA5127c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\nsDialogs.dllFilesize
9KB
MD5ab73c0c2a23f913eabdc4cb24b75cbad
SHA16569d2863d54c88dcf57c843fc310f6d9571a41e
SHA2563d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
SHA51299d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
-
C:\Users\Admin\AppData\Local\Temp\nsgFE5B.tmp\nsDialogs.dllFilesize
9KB
MD5ab73c0c2a23f913eabdc4cb24b75cbad
SHA16569d2863d54c88dcf57c843fc310f6d9571a41e
SHA2563d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
SHA51299d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
-
memory/5012-137-0x00000000022B1000-0x00000000022B4000-memory.dmpFilesize
12KB
-
memory/5012-142-0x0000000002311000-0x0000000002313000-memory.dmpFilesize
8KB