Analysis
-
max time kernel
190s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:43
Static task
static1
Behavioral task
behavioral1
Sample
6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7.exe
Resource
win10v2004-20220812-en
General
-
Target
6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7.exe
-
Size
8.6MB
-
MD5
a85e83f61d5a4cd1d7180d02920a4418
-
SHA1
dc3b7089c48136f256948ae16b4629b984bd1ab9
-
SHA256
6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7
-
SHA512
4d6f48b9ecce093fc2eabf241cc1ceba18f56d2fe348bbf7a8aded3ba5f699c8aacf440590b55774c7adccd9a5212794667b8b21a6963aa5a7693a71c6834948
-
SSDEEP
196608:t+EfQOSh1yoO5NOYhlR7XUnvjUmi+GG4y4lWqhTeZOpeVAr:IEebrUNOYhlR7XUvAmi+34bhTA0Dr
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7.exepid process 1116 6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7.exe 1116 6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7.exe 1116 6721af9181c33dc5516eb7cb85213df56c8c041d9b0d56873b16c50917a984d7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nskC219.tmp\NSISdl.dllFilesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
\Users\Admin\AppData\Local\Temp\nskC219.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
\Users\Admin\AppData\Local\Temp\nskC219.tmp\UIEx.dllFilesize
6KB
MD5ecd24b046df5838936b4ad9860f79c7c
SHA1f33fa4bdcfcd1a698cd45257e7db30b307989f2d
SHA25650576ef71d3d07ee1a6651d89395c2441314756ff7dd75063559675a7dae52c6
SHA51209747d14451e4e9586cc57337b6ccd25c11a6084e1d6a4e61fb9aa695ba5bb3a04430387dfff206acdd78d076b160395f8aeded1e0437cf365830ee457440c7f
-
memory/1116-54-0x0000000076931000-0x0000000076933000-memory.dmpFilesize
8KB