9fef2569a2570b70806120838c82b6012d36790205c82254b848ec862005ec3a

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe
Size

254KB
MD5

2832483a7a311902ae9fa5d7b6cf6eda
SHA1

cebd82649420adacb8a382665f175d479c8655af
SHA256

9fef2569a2570b70806120838c82b6012d36790205c82254b848ec862005ec3a
SHA512

652a448d43b5e7eda69018eedb17297f963eb771606096413fb1b7ee4f7b4da35c80e1aebcacf1954456267e23a1507b08a3a35bb318c4573b492c3a867d7f50
SSDEEP

6144:LBnbpM4DXtWFfsHj8DANpiTGgfKxtQD+R075MLx0r:FpTDXmsHlNpYGgwt3R0leU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

uuuhdi.exe

pid process

932 uuuhdi.exe
Loads dropped DLL 2 IoCs

Processes:

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe

pid process

828 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe
828 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
932	uuuhdi.exe

pid	process
828	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe
828	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe

description	pid	process	target process
PID 828 wrote to memory of 932	828	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe	uuuhdi.exe
PID 828 wrote to memory of 932	828	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe	uuuhdi.exe
PID 828 wrote to memory of 932	828	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe	uuuhdi.exe
PID 828 wrote to memory of 932	828	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe	uuuhdi.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29757.14304.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828

C:\Users\Admin\AppData\Local\Temp\uuuhdi.exe
"C:\Users\Admin\AppData\Local\Temp\uuuhdi.exe" C:\Users\Admin\AppData\Local\Temp\ucdbctarxpf.l
2⤵
- Executes dropped EXE
PID:932

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uuuhdi.exe
Filesize
58KB

MD5
0c69cbb68ffdfc24b3267782ba276862

SHA1
a84f0f14572a044441966a24102b63ad88b27a7a

SHA256
a0d5e4772b9e5f60c55ac720e045714197f7dac3d883d5d791ce4c3bc5015ec4

SHA512
b0f2fc93a1bd2d5e1b9138e83a2c2de2a77b7f14599a3137caa8b5522b71f57456113e62823f8a3522fae0994f8f832ec2b43c277ebcab31016a55978cc9b4e7

Download Submit
\Users\Admin\AppData\Local\Temp\uuuhdi.exe
Filesize
58KB

MD5
0c69cbb68ffdfc24b3267782ba276862

SHA1
a84f0f14572a044441966a24102b63ad88b27a7a

SHA256
a0d5e4772b9e5f60c55ac720e045714197f7dac3d883d5d791ce4c3bc5015ec4

SHA512
b0f2fc93a1bd2d5e1b9138e83a2c2de2a77b7f14599a3137caa8b5522b71f57456113e62823f8a3522fae0994f8f832ec2b43c277ebcab31016a55978cc9b4e7

Download Submit
\Users\Admin\AppData\Local\Temp\uuuhdi.exe
Filesize
58KB

MD5
0c69cbb68ffdfc24b3267782ba276862

SHA1
a84f0f14572a044441966a24102b63ad88b27a7a

SHA256
a0d5e4772b9e5f60c55ac720e045714197f7dac3d883d5d791ce4c3bc5015ec4

SHA512
b0f2fc93a1bd2d5e1b9138e83a2c2de2a77b7f14599a3137caa8b5522b71f57456113e62823f8a3522fae0994f8f832ec2b43c277ebcab31016a55978cc9b4e7

Download Submit
memory/828-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/932-57-0x0000000000000000-mapping.dmp

Download