Overview

overview

10

Static

static

5fb2f7c9db...da.exe

windows7-x64

7

5fb2f7c9db...da.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    27s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    16-01-2023 22:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5fb2f7c9db4b8231f1afa1cee755f1bb9ba79f3ae6f059601045f7ec5cd7efda.exe

  • Size

    397KB

  • MD5

    c5b07e99cb54792bd3ca1e3c7c4690d6

  • SHA1

    d0958f86bb03011d4336cc311d19e8fef2471f0f

  • SHA256

    5fb2f7c9db4b8231f1afa1cee755f1bb9ba79f3ae6f059601045f7ec5cd7efda

  • SHA512

    0f6d9f3826b5b44def15620f8bc8bb0a1f47fcb3bbd8e2d266d6d6020e59db099695f77c1deb5a405d0ce3c0b3e9dc35a308a50a0734923a72350c89b63ecf0b

  • SSDEEP

    12288:qTRFev0VcC2JU792CfQ7VUw4yqkzp6sXKMD:qTRo8cXY2q29XqIUsXx

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fb2f7c9db4b8231f1afa1cee755f1bb9ba79f3ae6f059601045f7ec5cd7efda.exe
    "C:\Users\Admin\AppData\Local\Temp\5fb2f7c9db4b8231f1afa1cee755f1bb9ba79f3ae6f059601045f7ec5cd7efda.exe"
    1⤵
    • Loads dropped DLL
    PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsj2696.tmp\System.dll
    Filesize

    12KB

    MD5

    564bb0373067e1785cba7e4c24aab4bf

    SHA1

    7c9416a01d821b10b2eef97b80899d24014d6fc1

    SHA256

    7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    SHA512

    22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    Download Submit
  • memory/1124-54-0x00000000753F1000-0x00000000753F3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1124-56-0x00000000023F0000-0x000000000303A000-memory.dmp
    Filesize

    12.3MB

    Download