d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f

Analysis

max time kernel
151s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2023 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
Size

30.1MB
MD5

449374446cd1c923fda322f32e764f30
SHA1

f95ce8b2cf8924afdb41b13e1ac31f899cc1db21
SHA256

d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f
SHA512

366e049a5e0dae1fa7cf135a16fecb8954935cf44908afc44998e86564fa288cd43bc516f18d1c6f6288020060c1454f53b15c0f23594668fc44b5f0d79c942c
SSDEEP

786432:hdIOmO0PH7gQBykalsqcSyUBlOE6n0/i/x6E1/qNP33A:hdIymH7gyy5GqfOBR8EYZ3A

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
3068	d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe

C:\Users\Admin\AppData\Local\Temp\d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe
"C:\Users\Admin\AppData\Local\Temp\d5767f2bf821dfd0547f5b961d69d39ad773fc0f20aedaffbdb303bc00c9474f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\CreateInstallScript.dll

Filesize
102KB

MD5
928f68555f19477586617b2480c589ef

SHA1
f458ade0a277b0117eda7e7b4a64b8128ed604a3

SHA256
988f4577be7babf7607926d7c26171c13587955f66ea677c55f8f75bc451c6aa

SHA512
3f7a69a881939b43e8fb9e91eddc0d2d2263d7670085bf4909b7550ae23e9235cdd99b68bb2853fb05c951746d7434801313e717e334064e86ba42c7a442f5d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\CreateInstallScript.dll

Filesize
102KB

MD5
928f68555f19477586617b2480c589ef

SHA1
f458ade0a277b0117eda7e7b4a64b8128ed604a3

SHA256
988f4577be7babf7607926d7c26171c13587955f66ea677c55f8f75bc451c6aa

SHA512
3f7a69a881939b43e8fb9e91eddc0d2d2263d7670085bf4909b7550ae23e9235cdd99b68bb2853fb05c951746d7434801313e717e334064e86ba42c7a442f5d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\InstallOptions.dll

Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\LangDLL.dll

Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\Processes.dll

Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\System.dll

Filesize
9KB

MD5
b7c1799cd69553e6ac51fe329376b2b8

SHA1
21f47ffdb983360171317e4a8cc3b3e0523b0e8d

SHA256
596606a63b104da2c0e583605ab887031b8ad781102782ffccffb665e517f213

SHA512
4029f93cc8508cd665c7856d10c870af4441187dd2b18d0fc0029efc3e35d8a7df167cb54b3c5c682c9cd0f9f2f266323cf5dbef45e503d44210679acee3c133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\installmode.ini

Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstB8D7.tmp\{AE6AC3F9-B8E9-4f4d-927C-9DFB2EC416A0}.ini

Filesize
2KB

MD5
d8a860b0921e864a680e2aee5c5484a7

SHA1
ac90b23ec9b694fc04c195a797bdb0aab7a011dc

SHA256
02ae1368b89d17b11bfc0037e4ceb53f0904292cd5d1523aff3986b0bde919ce

SHA512
6bc15226f1d6f6ac01e71846c3e71e108d24b7f5badbca5f42d880c538f4fbc28325d1e61e05c5610456fe14c75779bddaadedda694e908a4485b9ee6b52c9cb

Download Submit