Overview

overview

7

Static

static

1

c8d96ff517...34.exe

windows7-x64

7

c8d96ff517...34.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    43s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 04:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8d96ff517108ce23b0eba14ecdc7271a9e30431292cb82204450854c1ef3934.exe

  • Size

    3.0MB

  • MD5

    d7c23ab6663d86979855c51c9c8e76f8

  • SHA1

    5756bed9cff11e2c45d371c28ecd4275f168b9b8

  • SHA256

    c8d96ff517108ce23b0eba14ecdc7271a9e30431292cb82204450854c1ef3934

  • SHA512

    fd502e69708997456c9859a0755fa9e1d0356c98fa1bbd76a9a8e91908ef5f72131b85e9cc51aaf8243918cb3005572688ea7df9e0ebfb2187983880281028e6

  • SSDEEP

    49152:NdJZ71m06yKWN4BOhU0fGqA2o5OLlRfhzKkCA7Kw1UyxJgK2S6kYFKL:NdSLswZ723lNhz/r7lUyxJP2SBYFM

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8d96ff517108ce23b0eba14ecdc7271a9e30431292cb82204450854c1ef3934.exe
    "C:\Users\Admin\AppData\Local\Temp\c8d96ff517108ce23b0eba14ecdc7271a9e30431292cb82204450854c1ef3934.exe"
    1⤵
    • Loads dropped DLL
    PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\Base64.dll
    Filesize

    4KB

    MD5

    f0e3845fefd227d7f1101850410ec849

    SHA1

    3067203fafd4237be0c186ddab7029dfcbdfb53e

    SHA256

    7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    SHA512

    584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\DialogEx.dll
    Filesize

    22KB

    MD5

    ec138e15734e89232ed5a0e5ee5944ec

    SHA1

    8ec0f8460f2ac604a22de1b2d531766c80000d04

    SHA256

    71a46c7173d9c25b9e918a75fa12582ac2404d1b76eb54b28009ac5b73acd3fa

    SHA512

    4084a5903c2c2a0c2246b11ae61f122939d2e5273f4be0cd97dad6ba70501323edf18b9be0b8cfde23a3e752a695daacf87a596334c87c3a7217239916bd8bc1

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsjAD91.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit
  • memory/268-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp
    Filesize

    8KB

    Download