60b44811e34b25b5b2dd20695ec6df5c1b6598248dcf7d1bc819996c770f8e22

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2023, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe
Size 431KB
Sample230306-qxc8fsce83
SHA256 60b44811e34b25b5b2dd20695ec6df5c1b6598248dcf7d1bc819996c770f8e22
MD5 fa11625713888e5cfaaccc9d82eaab58
SHA1 2c74fbcc7ebaa7d3c111c62edc6693557575b1e8
SHA512 fac95b62527590fd40ef6aa1245782877d352d36c58860b2fc9a0919a6cd236beebdbfec6194fc2b9297be821501fa2908686966878faa93a7ae77dcb6f77dcd
SSDEEP 6144:HbUTp15lOVWR4vFSf00DZUNAIIn2ZEq30TygnfI6RvLYEXi90sqVM+LA:HIJlsW8200VUpEZu6RDjsy6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1980	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ltemaskiners\Visceropleural\Klinte\Unglamorously.Ops	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe
File created	C:\Program Files (x86)\Common Files\Futuristerne135\Ploratory.lnk	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\minuter\Sammenspares96.ini	JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe
"C:\Users\Admin\AppData\Local\Temp\JEALPER, SLU CONSTRUCCIONES S.L OFERTA 06032003.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6F3B.tmp\System.dll
Size 11KB
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1980-147-0x00000000041A0000-0x0000000006D8D000-memory.dmp

Download

memory/1980-148-0x00000000041A0000-0x0000000006D8D000-memory.dmp