bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b

Analysis

max time kernel
131s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe
Size

409KB
MD5

a6ff4fdb6fd9275f37dc4634d6121b6e
SHA1

60679d4821357fc81ef075b28025f1e6057d23bc
SHA256

bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b
SHA512

0efd99363036dfe4d2501fd362fa022748c69908d793de6ab863dcc21880ab285d2077c32880f157defc2ed3820e39aa7a8a40d01e053a58a6db6d75bd210c29
SSDEEP

6144:yGiZEMW+10ANDatDzdkzmvMOV+S9TRr0fi5F7Kbug+al+5gyqav5EpSM8W7h6E:XMW40Xpkm0yTRr15FlHEyHupSM86hX

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
744	bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
744	bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe

C:\Users\Admin\AppData\Local\Temp\bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe
"C:\Users\Admin\AppData\Local\Temp\bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso6EEB.tmp\InstallOptions.dll

Filesize
14KB

MD5
fa5beae80dba254fb6c21b58265f5310

SHA1
f2f776611dbbb157b151aa744a7e0be1d4b8c079

SHA256
34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269

SHA512
7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538

Download Submit
memory/744-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download