24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262

Analysis

max time kernel
160s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe
Size

70KB
MD5

abdc46c9df357347935b407f73701979
SHA1

e716ae4111a95dcadb0dac1d1254705f401fa7d4
SHA256

24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262
SHA512

fa9abcd241424ce2f433fcc4fbfcd55469fce1958cee1bb23ef4d654d1d3ed5d9d489c7e6c0865577a75e63258e18b8b27ab46fbe3e51c72c4f69eba661f8b38
SSDEEP

1536:SoAs868MBX80Stmv8oXJOhtsE2SDhEjgS4P1kmEAYw:RAsj8MBX8s0oXJQb2S9gOkmEAYw

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1752	24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe
1752	24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe
1752	24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe
1752	24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GeekShop Remote Support\supportgrc.exe	24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1752	24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe

C:\Users\Admin\AppData\Local\Temp\24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe
"C:\Users\Admin\AppData\Local\Temp\24f7370dafdf54f6bb9f1f73a6b758bb37d7b3a4fac63c7cabd2aaa35f683262.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy482A.tmp\LangDLL.dll

Filesize
5KB

MD5
feedca220d8a53786fa10dacadb75619

SHA1
174a3fbdf25fcec4799c4185507c1c8dbd0d2626

SHA256
5795c00a067c4d3a9f04bd34108c5541189c3f8d8d8ee75a3faef337f27cf909

SHA512
4f6a3549e52e02492591a062f2c5361344db3c632d0c4257bd1e06c7de67ede336279c6f57c287e3113f5d5834090ee23c9ad29d087d109b8d9700f5bfac67b2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy482A.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
\Users\Admin\AppData\Local\Temp\nsy482A.tmp\UserInfo.dll

Filesize
4KB

MD5
d9a3fc12d56726dde60c1ead1df366f7

SHA1
f531768159c14f07ac896437445652b33750a237

SHA256
401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

SHA512
6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

Download Submit
\Users\Admin\AppData\Local\Temp\nsy482A.tmp\nsisdl.dll

Filesize
14KB

MD5
00cc8456bdaa5b8356ade9d7910872fb

SHA1
6996cfbc0e12ac89d71f17eab170df8ccc86b1b6

SHA256
da9ed6fe10fbd507eac842883bbd07025f786cd6afc2855bb0bb51fe757956a6

SHA512
3b94adb44866a7c121457d8bc1689637f60e29e54927032f4fc78d68cf2b0feabc1e6dc1d2413b36f3af4f27933e6bd63156e93748870957f9d30dde353596ba

Download Submit
memory/1752-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download