b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2023 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
Size

27.0MB
MD5

88b635220d591a43eeb83b7c31526042
SHA1

4e60d8880c443408e4e23576782d3405e7f0a347
SHA256

b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f
SHA512

b2b7dc85acbabd054f6ca659703381f50fef62404e4993483dd886052d84723fbbd1831e13cdfa2d95ebd047a15037b3839988bb8304deb7020e89d1d59ab889
SSDEEP

786432:h0Toia9r/RlLvvG8TgFj7ObJChIRpt2mU:h8T0nLvv+EshIRpU9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
772	b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe

C:\Users\Admin\AppData\Local\Temp\b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe
"C:\Users\Admin\AppData\Local\Temp\b7fa92c8e5964344b04d4d1dd852e668c7a7a383b51772153119e82eb2ebf07f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\CreateInstallScript.dll

Filesize
102KB

MD5
db4176e15f3930d18a18c42a3cf37c7f

SHA1
1081cc31dedae348bdb3b1f2935074a486d28fb9

SHA256
8858d7b622138642c4db271f39ff069033ecc8cf8cb3f1f9cd59318c2b62faf8

SHA512
23e8e36e5bfeb8e6407df0360a3ebcf442e98ed24fee38d2d1b146f34441faa611459ada512d825ca484498ec939faaf735e261a39b6c8843336421af7039426

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\CreateInstallScript.dll

Filesize
102KB

MD5
db4176e15f3930d18a18c42a3cf37c7f

SHA1
1081cc31dedae348bdb3b1f2935074a486d28fb9

SHA256
8858d7b622138642c4db271f39ff069033ecc8cf8cb3f1f9cd59318c2b62faf8

SHA512
23e8e36e5bfeb8e6407df0360a3ebcf442e98ed24fee38d2d1b146f34441faa611459ada512d825ca484498ec939faaf735e261a39b6c8843336421af7039426

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\installmode.ini

Filesize
614B

MD5
322c3f9f7921ef0f2c9dd800b533b435

SHA1
d9aeee66ac8b714cf2a5b35c10170fb8f1c46a57

SHA256
ee45351fa57e7d2c322408d0cde8288d01f1be4128efd4f77959bffe64f9fe5f

SHA512
86601f07f70ccf9bdef72104abf835285afc0f9b093094854a291d9eb86484eb0bb5c5fadb75e3cbdc217918fef51662748678f73fab17ace4572b1ad9f746af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8F08.tmp\{AE6AC3F9-B8E9-4f4d-927C-9DFB2EC416A0}.ini

Filesize
2KB

MD5
1356659d14195fee20721e0dbc06f048

SHA1
7377b47bb56d50c5d86d7a1314f370b8020b029a

SHA256
e07a24a19ea535d49ecf1e77663564b8597e5d9bcdc7977b6d722907743281fd

SHA512
0ee382237f43fe3eae8370a13c887ec7547829053be7c304ededf75a888d4b465f90c434029207035adecf7c047d4e2a55040232008f5cdf12fd2ebdb78bdb20

Download Submit