60b44811e34b25b5b2dd20695ec6df5c1b6598248dcf7d1bc819996c770f8e22

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/03/2023, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe
Size

431KB
MD5

fa11625713888e5cfaaccc9d82eaab58
SHA1

2c74fbcc7ebaa7d3c111c62edc6693557575b1e8
SHA256

60b44811e34b25b5b2dd20695ec6df5c1b6598248dcf7d1bc819996c770f8e22
SHA512

fac95b62527590fd40ef6aa1245782877d352d36c58860b2fc9a0919a6cd236beebdbfec6194fc2b9297be821501fa2908686966878faa93a7ae77dcb6f77dcd
SSDEEP

6144:HbUTp15lOVWR4vFSf00DZUNAIIn2ZEq30TygnfI6RvLYEXi90sqVM+LA:HIJlsW8200VUpEZu6RDjsy6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1324	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ltemaskiners\Visceropleural\Klinte\Unglamorously.Ops	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe
File created	C:\Program Files (x86)\Common Files\Futuristerne135\Ploratory.lnk	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\minuter\Sammenspares96.ini	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe
"C:\Users\Admin\AppData\Local\Temp\JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd395B.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/1324-68-0x0000000003080000-0x0000000005C6D000-memory.dmp

Filesize
43.9MB

Download
memory/1324-69-0x0000000003080000-0x0000000005C6D000-memory.dmp

Filesize
43.9MB

Download