Analysis
-
max time kernel
78s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2023 17:00
Static task
static1
Behavioral task
behavioral1
Sample
UniSignCRSV3Setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
UniSignCRSV3Setup.exe
Resource
win10v2004-20230220-en
General
-
Target
UniSignCRSV3Setup.exe
-
Size
10.8MB
-
MD5
8ec94b17d6ad1d13ed96fbbf85ddb041
-
SHA1
450c8285e521462a5ebcf91d7370620e98037dc0
-
SHA256
ea0dfb50bb5de6c1b57c18948a89eeae675faf6423bd19dabbdc6f37f61e11b5
-
SHA512
72007272cf75f209aca095a012ac91b1a92ed650fa374fe71910268a9a1c42b9bfdf2c44296cd4359b961802c58306a8785a04a0c56163401b72c5fc1e7910ef
-
SSDEEP
196608:Y3k9aG+3Cb7/xO+efrKfgY294CsQV8vkaC/dyI3OuXerH4KYZ2Z2dn7HB5:YU9aGECv/xOrdbuklWuXgNSdN5
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
UniSignCRSV3Setup.exepid process 1636 UniSignCRSV3Setup.exe 1636 UniSignCRSV3Setup.exe 1636 UniSignCRSV3Setup.exe 1636 UniSignCRSV3Setup.exe 1636 UniSignCRSV3Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nstDE8E.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nstDE8E.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nstDE8E.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nstDE8E.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nstDE8E.tmp\KISA_HSAHVIEW_DLG.iniFilesize
2KB
MD5c148ebc7cab29762bbebb635a91fa484
SHA1ba280e6199706f654d26b7e5d584223c60d72e4c
SHA2564a0f832a23eaf2d2a55839db7a59fcd37101811734997c0e9be8a9a2f445093e
SHA51202de8481b0f162d40fc97514cf451ea9eeb2a0f0110c517b0043eaf783b38d2fd721684834aa7ce214c89a5fa4b3737fc71e542cd862d4698a8a20a38c7ace8f
-
C:\Users\Admin\AppData\Local\Temp\nstDE8E.tmp\LangDLL.dllFilesize
5KB
MD568b287f4067ba013e34a1339afdb1ea8
SHA145ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA25618e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA51206c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
-
C:\Users\Admin\AppData\Local\Temp\nstDE8E.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88