Analysis
-
max time kernel
65s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 11:44
Static task
static1
Behavioral task
behavioral1
Sample
d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe
Resource
win10v2004-20220812-en
General
-
Target
d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe
-
Size
908KB
-
MD5
d36c6a744592b03820482ba99b2216fa
-
SHA1
911c42ca67b3d82c9300d65bc80d7a367fb99f98
-
SHA256
d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb
-
SHA512
ab90d28ce2948aea578b9b37e1ce732855945dae92a315472738616eebcfd87c7fe5411627ddf602cf6b0b650ca66485f10584a2ba3f9c70e59215fee99b0806
-
SSDEEP
12288:Knby4m2z2OppNHITNQjVSK1QXDT1dGZVhjcIAFdkC2akBNowmj8r:Wy4m2iOpzHU+MOQzmVhjc7rQaUNowmj2
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exepid process 4856 d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe -
Drops file in Windows directory 1 IoCs
Processes:
d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exedescription ioc process File opened for modification C:\Windows\resources\0409\Extracurial\Drumbler\Skitserede.Tak d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsb7E00.tmp\System.dllFilesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
memory/4856-133-0x00000000049C0000-0x0000000005811000-memory.dmpFilesize
14.3MB
-
memory/4856-134-0x00000000049C0000-0x0000000005811000-memory.dmpFilesize
14.3MB