Overview

overview

7

Static

static

99c617c78e...59.exe

windows7-x64

7

99c617c78e...59.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2023, 08:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    99c617c78ecea5265d1828e14f7d6887a5e9e7b04992ed4c3268c38057c47c59.exe

  • Size

    853KB

  • MD5

    5c3c16e262958409da7db6c997bf7c00

  • SHA1

    8d616e2f75295196e9fcf9aad34003708ca8eb5f

  • SHA256

    99c617c78ecea5265d1828e14f7d6887a5e9e7b04992ed4c3268c38057c47c59

  • SHA512

    95611778e22286a6270658d6e5d6d6da7777b27fd55333eab443e5d1a93f6b88d63f6122c4d9b4ee1954eb6f9b8777228f16e45730a751013fce65244aa42416

  • SSDEEP

    24576:EnAUB54CVnVR6ID71BsLt85nAED7JWwiPje81DZ:4fdVR6ID7ER8PHiPjFZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99c617c78ecea5265d1828e14f7d6887a5e9e7b04992ed4c3268c38057c47c59.exe
    "C:\Users\Admin\AppData\Local\Temp\99c617c78ecea5265d1828e14f7d6887a5e9e7b04992ed4c3268c38057c47c59.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:836

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\nsyF4AE.tmp\InstallOptions.dll
          Filesize

          15KB

          MD5

          89351a0a6a89519c86c5531e20dab9ea

          SHA1

          9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

          SHA256

          f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

          SHA512

          13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsyF4AE.tmp\LockedList.dll
          Filesize

          28KB

          MD5

          2ee096682cc84f5fd44fb5291c00596c

          SHA1

          8dccebf054abe13e5b324dfdfbe6605553971396

          SHA256

          671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226

          SHA512

          1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsyF4AE.tmp\System.dll
          Filesize

          11KB

          MD5

          bf712f32249029466fa86756f5546950

          SHA1

          75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

          SHA256

          7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

          SHA512

          13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

          Download Submit

        • memory/836-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

          Filesize

          8KB

          Download