5e1e6e2e269216a8c40ab1dbba26b1b7d53f1f9f106cb94abbe7a4d1f38eb460

Analysis

max time kernel
7s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
12/03/2023, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BleachBit-4.4.2-setup.exe
Size

11.6MB
MD5

551192bf76a90dbd2b084b0e7820dd4d
SHA1

82f2b0c6cda922a8dbd7eb496ffbf8a7b435cdea
SHA256

5e1e6e2e269216a8c40ab1dbba26b1b7d53f1f9f106cb94abbe7a4d1f38eb460
SHA512

db1670faf0e184a46292a55d5706e423a2465f360e3207e75d909cc09e8ee5913dac6eb58c281ae917bba89c2c2f8c72c779a16792e08fec83f2323944e2b09e
SSDEEP

196608:Ok3KFcVqyXfRzYnP70IT+VdP/Vq4mKwekKH7YeZHL2jgcse8F4MeC2ebqhxZcT:OPyVyzl+VdP/VIxKs46Mcse8JeC2eGcT

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1980	BleachBit-4.4.2-setup.exe
1980	BleachBit-4.4.2-setup.exe
1980	BleachBit-4.4.2-setup.exe
1980	BleachBit-4.4.2-setup.exe
1980	BleachBit-4.4.2-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\BleachBit-4.4.2-setup.exe
"C:\Users\Admin\AppData\Local\Temp\BleachBit-4.4.2-setup.exe"
1⤵
- Loads dropped DLL
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsm98DC.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
\Users\Admin\AppData\Local\Temp\nsm98DC.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
\Users\Admin\AppData\Local\Temp\nsm98DC.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Local\Temp\nsm98DC.tmp\UserInfo.dll

Filesize
4KB

MD5
98ff85b635d9114a9f6a0cd7b9b649d0

SHA1
7a51b13aa86a445a2161fa1a567cdaecaa5c97c4

SHA256
933f93a30ce44df96cbc4ac0b56a8b02ee01da27e4ea665d1d846357a8fca8de

SHA512
562342532c437236d56054278d27195e5f8c7e59911fc006964149fc0420b1f9963d72a71ebf1cd3dfee42d991a4049a382f7e669863504c16f0fe7097a07a0a

Download Submit
\Users\Admin\AppData\Local\Temp\nsm98DC.tmp\nsDialogs.dll

Filesize
9KB

MD5
48f3e7860e1de2b4e63ec744a5e9582a

SHA1
420c64d802a637c75a53efc8f748e1aede3d6dc6

SHA256
6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156

SHA512
28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583

Download Submit