22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232

Analysis

max time kernel
128s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/03/2023, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe
Size

22.8MB
MD5

fece0c00ac3c35b2eb83e341128a9506
SHA1

be7e3572856ec659519269cbb1b4fe2560b58797
SHA256

22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232
SHA512

af16482ecb4c277a02821fe8a541cb1978b54ecf81be8ce756a042816164cd0e2b0ac23c41fa9682676c8f758dae7448aaac51ee90fbe0fcf40c3391172b4527
SSDEEP

393216:usEMYPsVHQLIUVv+8DuDo4IMpMBchLr5WjtfZXawGMcADjnownKefU0+i9hz0kYl:uMYsVoao4ROI6fFatMR7Kc3iyfd3xxC

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
924	22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe
924	22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe
924	22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe
924	22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
924	22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe

C:\Users\Admin\AppData\Local\Temp\22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe
"C:\Users\Admin\AppData\Local\Temp\22fcc1dc0a5a268ccbf9fde6a9295a45937806f491dcbee25395b239207ce232.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso1113.tmp\ioSpecial.ini

Filesize
668B

MD5
0cf0c41a8a7c9bd47c25cfd08f709cd0

SHA1
0f48804be79468fc5ea87adbcd7720f60947c394

SHA256
75763d70f3568eb306d235953b297c6439ab690b110593191bcbf1d2cd72152c

SHA512
e65066a81d06b465a97159887bc9ad5e6c711af4a45457328f4363bfa9ac17e43fa392bb841ef6690e1a7c53c8f0ee41d9b361158e54e883dc37a0875a5d78fa

Download Submit
\Users\Admin\AppData\Local\Temp\nso1113.tmp\InstallOptions.dll

Filesize
14KB

MD5
2a03c4a7ac5ee5e0e0a683949f70971b

SHA1
3bd9877caaea4804c0400420494ad1143179dcec

SHA256
d4f0042d8e7622b7e14395e926dd02edab3cdc77e82d88108b67a4d2cee9229b

SHA512
1942cdb522859f8dba46824786e361794a62e6201279201e1e0e2e07499fb6252933c5661782fccd77291c3650cafb2a7a08eee5431c8238f0da44840ee4c476

Download Submit
\Users\Admin\AppData\Local\Temp\nso1113.tmp\LangDLL.dll

Filesize
5KB

MD5
ebd0da54db9f12ffd15206cc24355793

SHA1
910be3bebdde55eb1ce05915a79f01ebdc622786

SHA256
4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6

SHA512
cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d

Download Submit
\Users\Admin\AppData\Local\Temp\nso1113.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Local\Temp\nso1113.tmp\UserInfo.dll

Filesize
4KB

MD5
8ef0e4eb7c89cdd2b552de746f5e2a53

SHA1
820f681e7cec409a02b194a487d1c8af1038acf0

SHA256
41293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc

SHA512
a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5

Download Submit