Overview

overview

7

Static

static

1

4a68938fe6...b4.exe

windows7-x64

7

4a68938fe6...b4.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 20:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a68938fe6e142f0d90b233f74bea35e8ce3121ef59ac781911bbb337c7ed4b4.exe

  • Size

    229KB

  • MD5

    1e8ba2b358d061421dd9cfffdc7feb1c

  • SHA1

    db758af4f71fabb3764aa3cb4780ddfaff4e61b3

  • SHA256

    4a68938fe6e142f0d90b233f74bea35e8ce3121ef59ac781911bbb337c7ed4b4

  • SHA512

    90125fda94deac81f56a875e1cdef264e4355e95b6339b43be28c42e580c6afdf921d9c7353505f08dda417c104faa257bb295070fc69a1bdfa713c5e73d3548

  • SSDEEP

    6144:Je34OUaD6ryo73LDAvaz2IeUl4GWscgPpIt5fH9Uww:eUaD6ryeLd/hhWcGH+

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a68938fe6e142f0d90b233f74bea35e8ce3121ef59ac781911bbb337c7ed4b4.exe
    "C:\Users\Admin\AppData\Local\Temp\4a68938fe6e142f0d90b233f74bea35e8ce3121ef59ac781911bbb337c7ed4b4.exe"
    1⤵
    • Loads dropped DLL
    PID:1616

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nskC847.tmp\LogEx.dll
    Filesize

    44KB

    MD5

    1c440ec84001c94327082aca9bdbd0d1

    SHA1

    4f35b29e8e1ca44368d15506c28a0873bed1c9f3

    SHA256

    f6d21ef2fa853b922c94d66d3abd9277ad71bc1be73a8d8418bc06635925a343

    SHA512

    32a2c9641d1390295249a52fab38f8bc8379be80395a9b27b4e157d37b66a1c1f9f49f940ccd24725c59f9de9a585690292119e11faea3e93d4054d9db00e93a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nskC847.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nskC847.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nskC847.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nskC847.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nskC847.tmp\NSISpcre.dll
    Filesize

    164KB

    MD5

    bfe060c22b44914e05d3f5367de6c9fe

    SHA1

    24c72b0b57b0066a5e8b235104a0502400e44b9a

    SHA256

    43041f8540dccbc33268bfbef53037d17170b037f6393e77c21429f303ae828f

    SHA512

    ad3a23edd8d62b198e4a2ccf03f6d607dee41fa23fd6f9dfabdc5ee424b5e22a6e00b8a28e50fe177829a2cc25ce05484423e97c682036fc5146e2adf560bc44

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nskC847.tmp\NSISpcre.dll
    Filesize

    164KB

    MD5

    bfe060c22b44914e05d3f5367de6c9fe

    SHA1

    24c72b0b57b0066a5e8b235104a0502400e44b9a

    SHA256

    43041f8540dccbc33268bfbef53037d17170b037f6393e77c21429f303ae828f

    SHA512

    ad3a23edd8d62b198e4a2ccf03f6d607dee41fa23fd6f9dfabdc5ee424b5e22a6e00b8a28e50fe177829a2cc25ce05484423e97c682036fc5146e2adf560bc44

    Download Submit

  • memory/1616-135-0x0000000002371000-0x0000000002374000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1616-138-0x00000000049C0000-0x00000000049EA000-memory.dmp

    Filesize

    168KB

    Download