b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f

Analysis

max time kernel
129s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-03-2023 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
Size

27.0MB
MD5

88b635220d591a43eeb83b7c31526042
SHA1

4e60d8880c443408e4e23576782d3405e7f0a347
SHA256

b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f
SHA512

b2b7dc85acbabd054f6ca659703381f50fef62404e4993483dd886052d84723fbbd1831e13cdfa2d95ebd047a15037b3839988bb8304deb7020e89d1d59ab889
SSDEEP

786432:h0Toia9r/RlLvvG8TgFj7ObJChIRpt2mU:h8T0nLvv+EshIRpU9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2044	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe

C:\Users\Admin\AppData\Local\Temp\b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
"C:\Users\Admin\AppData\Local\Temp\b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst85D.tmp\CreateInstallScript.dll

Filesize
102KB

MD5
db4176e15f3930d18a18c42a3cf37c7f

SHA1
1081cc31dedae348bdb3b1f2935074a486d28fb9

SHA256
8858d7b622138642c4db271f39ff069033ecc8cf8cb3f1f9cd59318c2b62faf8

SHA512
23e8e36e5bfeb8e6407df0360a3ebcf442e98ed24fee38d2d1b146f34441faa611459ada512d825ca484498ec939faaf735e261a39b6c8843336421af7039426

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst85D.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst85D.tmp\installmode.ini

Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst85D.tmp\{AE6AC3F9-B8E9-4f4d-927C-9DFB2EC416A0}.ini

Filesize
2KB

MD5
1356659d14195fee20721e0dbc06f048

SHA1
7377b47bb56d50c5d86d7a1314f370b8020b029a

SHA256
e07a24a19ea535d49ecf1e77663564b8597e5d9bcdc7977b6d722907743281fd

SHA512
0ee382237f43fe3eae8370a13c887ec7547829053be7c304ededf75a888d4b465f90c434029207035adecf7c047d4e2a55040232008f5cdf12fd2ebdb78bdb20

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\CreateInstallScript.dll

Filesize
102KB

MD5
db4176e15f3930d18a18c42a3cf37c7f

SHA1
1081cc31dedae348bdb3b1f2935074a486d28fb9

SHA256
8858d7b622138642c4db271f39ff069033ecc8cf8cb3f1f9cd59318c2b62faf8

SHA512
23e8e36e5bfeb8e6407df0360a3ebcf442e98ed24fee38d2d1b146f34441faa611459ada512d825ca484498ec939faaf735e261a39b6c8843336421af7039426

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
\Users\Admin\AppData\Local\Temp\nst85D.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit