629d76207addf10691b24a635ebb35de2d8304fdac77f146857727960f2715cb

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680.exe
Size

366KB
MD5

90e3b7c3ab8e0abd36736cad3675ea94
SHA1

8d258a23b86e189d1e6163b99f48888bb7f25dbd
SHA256

1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680
SHA512

f23bf155becae678d4e0f7f2a8c88f9e4f25c9c8d6d89599a789b7a4eff88d557a330935c7ac41e3c225cce7127e87cb446fa8bc0a96a539c2cb78457d524314
SSDEEP

6144:pmOP0zcxxjlS6q/hMPfpNJm0FLUSI/wmkDiItbmMoG71fXk7py7rBL+6NMt:cc/lNBNJm0gw5p1G8BL+6K

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1312	1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Hane\Chondrosin\Parthaveres\Laasemekanisme.ini	1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680.exe
File opened for modification	C:\Program Files (x86)\Saalegngerens\Drawerful\Stenstorm.Ass	1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680.exe
"C:\Users\Admin\AppData\Local\Temp\1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso204F.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/1312-54-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1312-56-0x0000000004430000-0x000000000891E000-memory.dmp

Filesize
68.9MB

Download
memory/1312-57-0x0000000004430000-0x000000000891E000-memory.dmp

Filesize
68.9MB

Download