ea0dfb50bb5de6c1b57c18948a89eeae675faf6423bd19dabbdc6f37f61e11b5

Analysis

max time kernel
128s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UniSignCRSV3Setup.exe
Size

10.8MB
MD5

8ec94b17d6ad1d13ed96fbbf85ddb041
SHA1

450c8285e521462a5ebcf91d7370620e98037dc0
SHA256

ea0dfb50bb5de6c1b57c18948a89eeae675faf6423bd19dabbdc6f37f61e11b5
SHA512

72007272cf75f209aca095a012ac91b1a92ed650fa374fe71910268a9a1c42b9bfdf2c44296cd4359b961802c58306a8785a04a0c56163401b72c5fc1e7910ef
SSDEEP

196608:Y3k9aG+3Cb7/xO+efrKfgY294CsQV8vkaC/dyI3OuXerH4KYZ2Z2dn7HB5:YU9aGECv/xOrdbuklWuXgNSdN5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

Processes:

UniSignCRSV3Setup.exe

pid process

1304 UniSignCRSV3Setup.exe
1304 UniSignCRSV3Setup.exe
1304 UniSignCRSV3Setup.exe
1304 UniSignCRSV3Setup.exe
1304 UniSignCRSV3Setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

UniSignCRSV3Setup.exe

pid process

1304 UniSignCRSV3Setup.exe

pid	process
1304	UniSignCRSV3Setup.exe
1304	UniSignCRSV3Setup.exe
1304	UniSignCRSV3Setup.exe
1304	UniSignCRSV3Setup.exe
1304	UniSignCRSV3Setup.exe

pid	process
1304	UniSignCRSV3Setup.exe

C:\Users\Admin\AppData\Local\Temp\UniSignCRSV3Setup.exe
"C:\Users\Admin\AppData\Local\Temp\UniSignCRSV3Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1304

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst80E.tmp\InstallOptions.dll
Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst80E.tmp\KISA_HSAHVIEW_DLG.ini
Filesize
2KB

MD5
331c906d715acfe66464136182aabd7d

SHA1
05a9ec7e43404802c1cfa4991e3ea76468d99bee

SHA256
e2b2a8a235c3355c46a4665876cfd9f3e1d0d3f011e6eeec6c20a5fed5c02ba2

SHA512
93d5f107e506d86817c20a3eb42b2113f98c2beed9845bec742b8b755069e5c1331601ff555ccd3cc1f790d5aa8c0eb2ae40dd75a2cd6f4bc81c9b5bac625e21

Download Submit
\Users\Admin\AppData\Local\Temp\nst80E.tmp\InstallOptions.dll
Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
\Users\Admin\AppData\Local\Temp\nst80E.tmp\InstallOptions.dll
Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
\Users\Admin\AppData\Local\Temp\nst80E.tmp\InstallOptions.dll
Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
\Users\Admin\AppData\Local\Temp\nst80E.tmp\LangDLL.dll
Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
\Users\Admin\AppData\Local\Temp\nst80E.tmp\System.dll
Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads