07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83

Analysis

max time kernel
163s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe
Size

17.1MB
MD5

67824f74f394bee5c51e40367ed5a524
SHA1

c10a6d8ee73d9208744936ffaa2dd7dc23ec1276
SHA256

07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83
SHA512

1bcea15922939408bd0d2a13fc521a984d2d8015884959c902fe6390597bc136a1a19f536f8c726c6274e34d73f1be7cc9710c8e667e9ae8cb0c0c8a7f6b1245
SSDEEP

196608:8xGmuXPSZu5nwQvirdaNq2FjOICUMz+BOGeuiAkNtqj42+jb8UvCaXEvnjjuDsig:BmuXAoaUNtF92Ue1eMbWjcKroBhJw51b

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4828	07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe
4828	07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe
4828	07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe
4828	07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe
4828	07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe
"C:\Users\Admin\AppData\Local\Temp\07e377cb90be341f82acb897e87ad2187fb2afd97d50c52a40206d35f8ea5c83.exe"
1⤵
- Loads dropped DLL
PID:4828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nseD1CD.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD1CD.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD1CD.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD1CD.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD1CD.tmp\dui.dll

Filesize
92KB

MD5
2c6689e9e49625b7dd61ac49bcf94562

SHA1
3b067922b42b1b8ff483d38bd27905e3dc1772db

SHA256
93f612786957bdd95a858f7c294f2d68256b6d2271c69ee96235732348b859d4

SHA512
f6e873bb8cbff566360f1731e83dd5dea5f4477442f8eba963f9475f98fef187d09eb998cc62df7927fa1237bc381b3321ebe55ea4bcca271a2a17eba3e9ac8a

Download Submit
memory/4828-136-0x00000000006C1000-0x00000000006C4000-memory.dmp

Filesize
12KB

Download