Overview

overview

7

Static

static

1

cb7e3fcc7b...d6.exe

windows7-x64

7

cb7e3fcc7b...d6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    193s
  • max time network
    226s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 17:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cb7e3fcc7b3981f8d88f4cc347a07239afadc3f8969d6937b2b2ad640f8274d6.exe

  • Size

    25.2MB

  • MD5

    d47f262cae8a96f6cdfc5e9f0f52eaf1

  • SHA1

    46a292da9bd0fc1a2ddc4a0a580c66ec9ccd34e6

  • SHA256

    cb7e3fcc7b3981f8d88f4cc347a07239afadc3f8969d6937b2b2ad640f8274d6

  • SHA512

    2887d99fb5e22b8d3c4fc823430cfe0a3bd4d373cb74283f9461385e99c9fe449d8aba82c568c403d7d5be47a96e0d46d87827f103701fbd280fb0d5040a9497

  • SSDEEP

    786432:7353YcY7xzZkgvGvcSKrjgSYK14k4kFsCm4B0lUJY:73mcgMgOTAgG4k4KY

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb7e3fcc7b3981f8d88f4cc347a07239afadc3f8969d6937b2b2ad640f8274d6.exe
    "C:\Users\Admin\AppData\Local\Temp\cb7e3fcc7b3981f8d88f4cc347a07239afadc3f8969d6937b2b2ad640f8274d6.exe"
    1⤵
    • Loads dropped DLL
    PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nscA569.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nscA569.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nscA569.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nscA569.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nscA569.tmp\dui.dll
    Filesize

    92KB

    MD5

    2c6689e9e49625b7dd61ac49bcf94562

    SHA1

    3b067922b42b1b8ff483d38bd27905e3dc1772db

    SHA256

    93f612786957bdd95a858f7c294f2d68256b6d2271c69ee96235732348b859d4

    SHA512

    f6e873bb8cbff566360f1731e83dd5dea5f4477442f8eba963f9475f98fef187d09eb998cc62df7927fa1237bc381b3321ebe55ea4bcca271a2a17eba3e9ac8a

    Download Submit
  • memory/668-136-0x0000000003001000-0x0000000003004000-memory.dmp
    Filesize

    12KB

    Download