Overview

overview

10

Static

static

5e79854b8a...63.exe

windows7-x64

7

5e79854b8a...63.exe

windows10-2004-x64

10

f6fbfa9fe3...b4.exe

windows7-x64

7

f6fbfa9fe3...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    222s
  • max time network
    336s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2022 09:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4.exe

  • Size

    1.5MB

  • MD5

    48aa442a0670b65a82eee99c1ed1ac78

  • SHA1

    12117609b746257a6cdd2808dcb50c6af9c1810d

  • SHA256

    f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4

  • SHA512

    f76db6e03154e7221f26b3329c434f00d775f99411ee9ec258652a0a7f52c90e0de9794d6754b5910cf169776ae87abf982cd778eb6f06b69fe5a11135e26e5c

  • SSDEEP

    24576:9bas1P80H8OziJNLCubRnkkBqKU3QMNrm1gPB7MjsjfoxKHHU4tsQkdZ:VlH8ucW9jhmyPBYjSzHHU4tshdZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4.exe
    "C:\Users\Admin\AppData\Local\Temp\f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4.exe"
    1⤵
    • Loads dropped DLL
    PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsz342C.tmp\System.dll
    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    Download Submit
  • memory/560-54-0x0000000075551000-0x0000000075553000-memory.dmp
    Filesize

    8KB

    Download