Overview

overview

8

Static

static

1

a0da34fa50...4c.exe

windows7-x64

8

a0da34fa50...4c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    113s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 08:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe

  • Size

    1.2MB

  • MD5

    887b26530cbe5a383d8f07d54c668b75

  • SHA1

    a741359271ac565164ad3883fdae11fdda78ff18

  • SHA256

    a0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c

  • SHA512

    0bc7c0b29af380719cb93f3bfe0a272ef32d470584b458c67ec4b1afabae859c294f50d3997db55c34812c9b4a6bec7c62af033ecaf2bb3e9e3ed06c7e8aaf2e

  • SSDEEP

    24576:vVzeucL/zIB2XwIrxTM8L67NIOUqK2jTwaP0CisDQTY0qiabIHsdsvHA5FR8mdh:YuK0BMnrxTDL7Rq5kCisDD1iLM6g5FRT

Score
8/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
    "C:\Users\Admin\AppData\Local\Temp\a0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
      "C:\Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:556
      • C:\Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
        C:\Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe /SECONDSTAGE /Mutex=TSMtx2756 /PIXGUID=99999999-9999-4ba7-a299-e8d484d99a71
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
    Filesize

    1.2MB

    MD5

    4029266a463eda6b85521878c2d54c3e

    SHA1

    406413c613a4145b5ad88ec7001128931e8a6463

    SHA256

    fa65f8b9dafd34b2f28ca93366777a91baebedb5cff97911734e5cf445e967e1

    SHA512

    e392af9725fd4ddfb1d132ab901639bbf51479af7680a6a6eb1e0b26f9208e26a1d5d121f3a6d81b544652b457783a385fdf400aeb445a4f632b9e147e782627

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
    Filesize

    1.2MB

    MD5

    4029266a463eda6b85521878c2d54c3e

    SHA1

    406413c613a4145b5ad88ec7001128931e8a6463

    SHA256

    fa65f8b9dafd34b2f28ca93366777a91baebedb5cff97911734e5cf445e967e1

    SHA512

    e392af9725fd4ddfb1d132ab901639bbf51479af7680a6a6eb1e0b26f9208e26a1d5d121f3a6d81b544652b457783a385fdf400aeb445a4f632b9e147e782627

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
    Filesize

    1.2MB

    MD5

    4029266a463eda6b85521878c2d54c3e

    SHA1

    406413c613a4145b5ad88ec7001128931e8a6463

    SHA256

    fa65f8b9dafd34b2f28ca93366777a91baebedb5cff97911734e5cf445e967e1

    SHA512

    e392af9725fd4ddfb1d132ab901639bbf51479af7680a6a6eb1e0b26f9208e26a1d5d121f3a6d81b544652b457783a385fdf400aeb445a4f632b9e147e782627

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nseE13E.tmp\D1989.dll
    Filesize

    14KB

    MD5

    904beebec2790ee2ca0c90fc448ac7e0

    SHA1

    40fabf1eb0a3b7168351c4514c5288216cb1566d

    SHA256

    f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

    SHA512

    8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
    Filesize

    1.2MB

    MD5

    4029266a463eda6b85521878c2d54c3e

    SHA1

    406413c613a4145b5ad88ec7001128931e8a6463

    SHA256

    fa65f8b9dafd34b2f28ca93366777a91baebedb5cff97911734e5cf445e967e1

    SHA512

    e392af9725fd4ddfb1d132ab901639bbf51479af7680a6a6eb1e0b26f9208e26a1d5d121f3a6d81b544652b457783a385fdf400aeb445a4f632b9e147e782627

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nseE13E.tmp\DCa0da34fa50da112ce7706be876d7efc1890f8be98d33102bee32d92190b0914c.exe
    Filesize

    1.2MB

    MD5

    4029266a463eda6b85521878c2d54c3e

    SHA1

    406413c613a4145b5ad88ec7001128931e8a6463

    SHA256

    fa65f8b9dafd34b2f28ca93366777a91baebedb5cff97911734e5cf445e967e1

    SHA512

    e392af9725fd4ddfb1d132ab901639bbf51479af7680a6a6eb1e0b26f9208e26a1d5d121f3a6d81b544652b457783a385fdf400aeb445a4f632b9e147e782627

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nseE13E.tmp\System.dll
    Filesize

    11KB

    MD5

    a436db0c473a087eb61ff5c53c34ba27

    SHA1

    65ea67e424e75f5065132b539c8b2eda88aa0506

    SHA256

    75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    SHA512

    908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    Download Submit

  • memory/2004-54-0x0000000075671000-0x0000000075673000-memory.dmp

    Filesize

    8KB

    Download