a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100

Analysis

max time kernel
151s
max time network
74s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12/02/2023, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
Size

3.8MB
MD5

76142ae6bc689eb649429cdac475a0fc
SHA1

d8cdfdcc92477b552ebd53675df5b8c9261028fb
SHA256

a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100
SHA512

3255a36f76403700af979ddf07d950a6f1496f071fb2a13adfb7627961dafd0d43df3fb425bb68a10ad2ad32192b2bb5e4699de56086f9902992005c798da453
SSDEEP

49152:Wx211wH2PLA5SSRLRG/nMPEZEHyTM7wdOYv:e2EH2Db67wAy

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nottepad.exe	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nottepad.exe	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe

Executes dropped EXE 1 IoCs

pid	Process
1452	nod42.exe

Loads dropped DLL 1 IoCs

pid	Process
1128	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\Z:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\P:	nod42.exe
File opened (read-only)	\??\R:	nod42.exe
File opened (read-only)	\??\X:	nod42.exe
File opened (read-only)	\??\A:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\H:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\L:	nod42.exe
File opened (read-only)	\??\S:	nod42.exe
File opened (read-only)	\??\V:	nod42.exe
File opened (read-only)	\??\W:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\E:	nod42.exe
File opened (read-only)	\??\Q:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\F:	nod42.exe
File opened (read-only)	\??\G:	nod42.exe
File opened (read-only)	\??\K:	nod42.exe
File opened (read-only)	\??\N:	nod42.exe
File opened (read-only)	\??\Y:	nod42.exe
File opened (read-only)	\??\N:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\P:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\X:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\O:	nod42.exe
File opened (read-only)	\??\Q:	nod42.exe
File opened (read-only)	\??\T:	nod42.exe
File opened (read-only)	\??\U:	nod42.exe
File opened (read-only)	\??\E:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\S:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\L:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\V:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\G:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\J:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\B:	nod42.exe
File opened (read-only)	\??\J:	nod42.exe
File opened (read-only)	\??\K:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\O:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\M:	nod42.exe
File opened (read-only)	\??\W:	nod42.exe
File opened (read-only)	\??\Z:	nod42.exe
File opened (read-only)	\??\B:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\F:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\T:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\U:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\Y:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\A:	nod42.exe
File opened (read-only)	\??\H:	nod42.exe
File opened (read-only)	\??\I:	nod42.exe
File opened (read-only)	\??\I:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\R:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1452	1128	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe	28
PID 1128 wrote to memory of 1452	1128	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe	28
PID 1128 wrote to memory of 1452	1128	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe	28
PID 1128 wrote to memory of 1452	1128	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe	28

C:\Users\Admin\AppData\Local\Temp\d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
"C:\Users\Admin\AppData\Local\Temp\d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\Documen\nod42.exe
  "C:\Users\Admin\Documen\nod42.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documen\nod42.exe

Filesize
3.8MB

MD5
76142ae6bc689eb649429cdac475a0fc

SHA1
d8cdfdcc92477b552ebd53675df5b8c9261028fb

SHA256
a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100

SHA512
3255a36f76403700af979ddf07d950a6f1496f071fb2a13adfb7627961dafd0d43df3fb425bb68a10ad2ad32192b2bb5e4699de56086f9902992005c798da453

Download Submit
\Users\Admin\Documen\nod42.exe

Filesize
3.8MB

MD5
76142ae6bc689eb649429cdac475a0fc

SHA1
d8cdfdcc92477b552ebd53675df5b8c9261028fb

SHA256
a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100

SHA512
3255a36f76403700af979ddf07d950a6f1496f071fb2a13adfb7627961dafd0d43df3fb425bb68a10ad2ad32192b2bb5e4699de56086f9902992005c798da453

Download Submit
memory/1128-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download