Overview

overview

10

Static

static

1

df148634d4...f9.exe

windows7-x64

10

df148634d4...f9.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    90s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2023 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

  • Size

    613KB

  • MD5

    598006943c00897342521805a95ca553

  • SHA1

    ff0d0e310dcff0011161515c504df7d49dbeba7b

  • SHA256

    df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9

  • SHA512

    efa3006bde7ce0f05cf9bf11ee5beb700b2a9539d532b883906606db18c6a72e1fe9c7e414f41c76f54a17aa0a78350fd4ee93ff6fc0387bb24769a235a9a499

  • SSDEEP

    6144:VGYgXWlQw/LOvqf+fNu8HQc4o97VsAHWUt0TNBpt8OGM8eow6oW8TWBa2T4Wrdc9:ADGz0I+M8J52U0NuMrs748dX2

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe
    "C:\Users\Admin\AppData\Local\Temp\df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:4936

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst772B.tmp\System.dll
    Filesize

    11KB

    MD5

    ee260c45e97b62a5e42f17460d406068

    SHA1

    df35f6300a03c4d3d3bd69752574426296b78695

    SHA256

    e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

    SHA512

    a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3

    Download Submit
  • memory/4936-133-0x00000000033A0000-0x000000000347B000-memory.dmp
    Filesize

    876KB

    Download