0779e4566cc7627e1bbec517148ab1b2a89600d1a1ad291e68a79f6910b911b1

Analysis

max time kernel
47s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/03/2023, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CuatroQuintos_setup.exe
Size

21.9MB
MD5

fdd7ae19112850292609313b406cca18
SHA1

e12777831524f7481ace5e2e5f4c6cf15306a9cb
SHA256

0779e4566cc7627e1bbec517148ab1b2a89600d1a1ad291e68a79f6910b911b1
SHA512

44f8193f733011e2f30b9391bd023bc7dd12bf68cd00b12514f33d382b952ac179f9f10ffbdfc3a4f08d8ff3a3eee88fa9b79026d55e0201fcde030a9d71c3ab
SSDEEP

393216:e2yWEUqISHMt49tLtaD5q1B7giGVpDKqx8T+7iyy2rq0UEdCcpG/k:eSE/ISHfzw43GfDKo8yQhjABpGc

Score

7^/10

pyinstaller

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1712	CuatroQuintos.exe

Loads dropped DLL 7 IoCs

pid	Process
928	CuatroQuintos_setup.exe
928	CuatroQuintos_setup.exe
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1712	CuatroQuintos.exe

Detects Pyinstaller 6 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000012706-279.dat	pyinstaller
behavioral1/files/0x0007000000012706-280.dat	pyinstaller
behavioral1/files/0x0007000000012706-282.dat	pyinstaller
behavioral1/files/0x0007000000012706-281.dat	pyinstaller
behavioral1/files/0x0007000000012706-289.dat	pyinstaller
behavioral1/files/0x0007000000012706-290.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\CuatroQuintos_setup.exe
"C:\Users\Admin\AppData\Local\Temp\CuatroQuintos_setup.exe"
1⤵
- Loads dropped DLL
PID:928

C:\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe
"C:\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy119F.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy119F.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy119F.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe

Filesize
5.8MB

MD5
4d96571255510e619e7ae9f6e4feaae9

SHA1
587e2743eecadba8cdbc09a1a71aa3ee2736190d

SHA256
b80623ca29d12ffbd7fce2591572dc59d576f09ba254e0c8cd3c862808e72e55

SHA512
ca1646d210645467e8e2949d5158aada9a74f9ee073bd932d2968ca5fc9fd7e8f4cf9b92bcb40232563b37ba1dae9ca17a7ba204c339dd9d1f9a3093f8dd92f5

Download Submit
C:\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe

Filesize
5.8MB

MD5
4d96571255510e619e7ae9f6e4feaae9

SHA1
587e2743eecadba8cdbc09a1a71aa3ee2736190d

SHA256
b80623ca29d12ffbd7fce2591572dc59d576f09ba254e0c8cd3c862808e72e55

SHA512
ca1646d210645467e8e2949d5158aada9a74f9ee073bd932d2968ca5fc9fd7e8f4cf9b92bcb40232563b37ba1dae9ca17a7ba204c339dd9d1f9a3093f8dd92f5

Download Submit
C:\Users\Admin\Documents\LolinohhGames\CuatroQuintos\python311.dll

Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
\Users\Admin\AppData\Local\Temp\nsy119F.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsy119F.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe

Filesize
5.8MB

MD5
4d96571255510e619e7ae9f6e4feaae9

SHA1
587e2743eecadba8cdbc09a1a71aa3ee2736190d

SHA256
b80623ca29d12ffbd7fce2591572dc59d576f09ba254e0c8cd3c862808e72e55

SHA512
ca1646d210645467e8e2949d5158aada9a74f9ee073bd932d2968ca5fc9fd7e8f4cf9b92bcb40232563b37ba1dae9ca17a7ba204c339dd9d1f9a3093f8dd92f5

Download Submit
\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe

Filesize
5.8MB

MD5
4d96571255510e619e7ae9f6e4feaae9

SHA1
587e2743eecadba8cdbc09a1a71aa3ee2736190d

SHA256
b80623ca29d12ffbd7fce2591572dc59d576f09ba254e0c8cd3c862808e72e55

SHA512
ca1646d210645467e8e2949d5158aada9a74f9ee073bd932d2968ca5fc9fd7e8f4cf9b92bcb40232563b37ba1dae9ca17a7ba204c339dd9d1f9a3093f8dd92f5

Download Submit
\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe

Filesize
5.8MB

MD5
4d96571255510e619e7ae9f6e4feaae9

SHA1
587e2743eecadba8cdbc09a1a71aa3ee2736190d

SHA256
b80623ca29d12ffbd7fce2591572dc59d576f09ba254e0c8cd3c862808e72e55

SHA512
ca1646d210645467e8e2949d5158aada9a74f9ee073bd932d2968ca5fc9fd7e8f4cf9b92bcb40232563b37ba1dae9ca17a7ba204c339dd9d1f9a3093f8dd92f5

Download Submit
\Users\Admin\Documents\LolinohhGames\CuatroQuintos\CuatroQuintos.exe

Filesize
5.8MB

MD5
4d96571255510e619e7ae9f6e4feaae9

SHA1
587e2743eecadba8cdbc09a1a71aa3ee2736190d

SHA256
b80623ca29d12ffbd7fce2591572dc59d576f09ba254e0c8cd3c862808e72e55

SHA512
ca1646d210645467e8e2949d5158aada9a74f9ee073bd932d2968ca5fc9fd7e8f4cf9b92bcb40232563b37ba1dae9ca17a7ba204c339dd9d1f9a3093f8dd92f5

Download Submit
\Users\Admin\Documents\LolinohhGames\CuatroQuintos\python311.dll

Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit