Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 11:49
Static task
static1
Behavioral task
behavioral1
Sample
45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exe
Resource
win10v2004-20221111-en
General
-
Target
45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exe
-
Size
940KB
-
MD5
b5648913e12f4e89cb997c6b1971f91c
-
SHA1
08f7a80b7af7710863b0ed69a2e45b9367b8e703
-
SHA256
ba3aa0c64894eb657392a4c0aba0058092fe29bd15356989347f7899179d806a
-
SHA512
7b0c7c0f56a03f04852ea0c581d199467febcdb181953c12dc2aadbc75b4c02233b492cc22d6780b3cd225202ba75f07fb28c2669fcb3f3d79069cf4b651a617
-
SSDEEP
24576:QVFB2reMzi1ucAlicOY30yS1u9Yl2AeovgiGzyRGLPAoe:Q1+wkTT30yiuoeovgiGeRkYf
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
Processes:
45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exepid process 752 45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exe 752 45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exe 752 45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exe 752 45.77.194.187_-_calc.exe___b5648913e12f4e89cb997c6b1971f91c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsiFA1A.tmp\BrandingURL.dllFilesize
4KB
MD571c46b663baa92ad941388d082af97e7
SHA15a9fcce065366a526d75cc5ded9aade7cadd6421
SHA256bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
SHA5125965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
-
\Users\Admin\AppData\Local\Temp\nsiFA1A.tmp\LangDLL.dllFilesize
5KB
MD59384f4007c492d4fa040924f31c00166
SHA1aba37faef30d7c445584c688a0b5638f5db31c7b
SHA25660a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA51268f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
\Users\Admin\AppData\Local\Temp\nsiFA1A.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
\Users\Admin\AppData\Local\Temp\nsiFA1A.tmp\nsDialogs.dllFilesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
-
memory/752-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB