14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345

Analysis

max time kernel
192s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe
Size

7.2MB
MD5

74add766aee64d6837ec006d26c5df4b
SHA1

9f36d87ca4ef8d9960e00b18ee3bb9418ed1ba1e
SHA256

14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345
SHA512

9ef41141cf40e14afd8e5654a0608fbd2532848fee40cb675fb27f30eda765130ddbb831e5aa8c2c880019dd2145372b328e907564764f3e8ed8ebb607158bfe
SSDEEP

196608:pYzaOsdLsghtf3gTT5qv9C73bpsblN8ITNw7jjWl:osJxlwHUVaulN8Ywb2

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
3196	14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe
3196	14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe
3196	14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe
3196	14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe
3196	14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe
3196	14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe
"C:\Users\Admin\AppData\Local\Temp\14d3fee65c7c68de010b8666e475fc5390bb5502edd23207378007d2265aa345.exe"
1⤵
- Loads dropped DLL
PID:3196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsrFD5C.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrFD5C.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrFD5C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrFD5C.tmp\TvBlackListForNSIS.dll

Filesize
77KB

MD5
7c75f35a556ad4b1c94940a0f39c10f4

SHA1
89a9c1f6170bf2397b6238d159f7d04384b123f1

SHA256
172b53cf238e244021303007e45f6a5e83d5744a5c848dbd55518d4a8af05d3d

SHA512
11fc87ff6d58aa9a811285658889772cd957232223791739fd78f9a41b52141519385958ed92c9beae75af5f38f1e0ac0abc0fe10c7fa21d519dd74434627a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrFD5C.tmp\TvBlackListForNSIS.dll

Filesize
77KB

MD5
7c75f35a556ad4b1c94940a0f39c10f4

SHA1
89a9c1f6170bf2397b6238d159f7d04384b123f1

SHA256
172b53cf238e244021303007e45f6a5e83d5744a5c848dbd55518d4a8af05d3d

SHA512
11fc87ff6d58aa9a811285658889772cd957232223791739fd78f9a41b52141519385958ed92c9beae75af5f38f1e0ac0abc0fe10c7fa21d519dd74434627a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrFD5C.tmp\TvBlackListForNSIS.dll

Filesize
77KB

MD5
7c75f35a556ad4b1c94940a0f39c10f4

SHA1
89a9c1f6170bf2397b6238d159f7d04384b123f1

SHA256
172b53cf238e244021303007e45f6a5e83d5744a5c848dbd55518d4a8af05d3d

SHA512
11fc87ff6d58aa9a811285658889772cd957232223791739fd78f9a41b52141519385958ed92c9beae75af5f38f1e0ac0abc0fe10c7fa21d519dd74434627a60

Download Submit
memory/3196-138-0x00000000029C1000-0x00000000029C3000-memory.dmp

Filesize
8KB

Download