1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c

Analysis

max time kernel
44s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe
Size

1.1MB
MD5

82702f14c5aebda93ccdda0f5e8ca78f
SHA1

b832103efab4c2962e6c45f39b59cf708db5c833
SHA256

1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c
SHA512

8741f1e7968124a5c0674a1dc8f1a8947d66786cac685225ebf8eddbaca6d15cea99eeee5f82b05bd5ef73f8cc40fdfcc3676210ef47bf5460675bbd4c1eda0a
SSDEEP

24576:bnfDFo5gVOxKA/6kho6g9GQDmFZlzNhZ+Ab+1gr5XEMb2ly8yyw+F077WpzOdQA8:bnBoNKA/phvg9GQSzBqgrNDH8yyfy77o

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

Processes:

1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe

pid	process
1064	1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe
1064	1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe
1064	1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe
1064	1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe
1064	1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe
"C:\Users\Admin\AppData\Local\Temp\1347b833ce4226159e7381c109d73a74ef34d839c87bd76c01a8cb508d916a3c.exe"
1⤵
- Loads dropped DLL
PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nseB8B8.tmp\SkinBtn.dll

Filesize
4KB

MD5
e4ec95271ff1bcebab49bdfed6817a22

SHA1
2c03e97f4773aea80ecdb98a1482e5896fe4677b

SHA256
ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6

SHA512
771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d

Download Submit
\Users\Admin\AppData\Local\Temp\nseB8B8.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nseB8B8.tmp\WndProc.dll

Filesize
3KB

MD5
f0cb331dd4bd92a6ebce45e7cd1cf5ef

SHA1
b66ea0c10b08750295f2dc7c170b370402393214

SHA256
e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458

SHA512
7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271

Download Submit
\Users\Admin\AppData\Local\Temp\nseB8B8.tmp\nsDialogs.dll

Filesize
9KB

MD5
ab73c0c2a23f913eabdc4cb24b75cbad

SHA1
6569d2863d54c88dcf57c843fc310f6d9571a41e

SHA256
3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457

SHA512
99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8

Download Submit
\Users\Admin\AppData\Local\Temp\nseB8B8.tmp\nsWindows.dll

Filesize
10KB

MD5
480f41c61ef59b1dbde50427b3d095b2

SHA1
3d9e0f6d7c5912bd2ba086176d50ec7864c44af3

SHA256
fd46a3f37937707c4b584a268b0728db92d974bea61e5cf4bad628869f8f7be9

SHA512
ffb3d5f05b66aabf69a133199a663f7ab17d5e9ced679938b51f85402153bd41d90e07c4bd77b50227602f70c47454e8285232261b0a1ce5265c4d77d726a1c2

Download Submit
memory/1064-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download