d1c09f505d9483e93df5126241c209e8c871656493ce511b3238df73b3eee71f

Resubmissions

19-03-2023 02:41

230319-c6rwbagf4y 7

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-03-2023 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSIAfterburnerSetup465Beta4.exe
Size

53.4MB
MD5

85bffc78f283e9cdf26e1886ec945b12
SHA1

cdfb44817a2ae33706229922d339dc633b455388
SHA256

4ed693538994b649c5eda5f84daaadf9bf017b9d5ec99e5aacf25c8fd2fd75b5
SHA512

5371963919ef2b13ba5dc0f5d90e13857de76234bcba85f91e6ee8e9f585dc701334c371737f6917e461dc4296f0659071bab5ab9dece776294d7f4b075af6f9
SSDEEP

1572864:ZDyWOEc9XMwDUGt76mPxTGt76FPRX8i7kpOMPt:ZWLfFMwt7Zat7xZAMPt

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

MSIAfterburnerSetup465Beta4.exe

pid process

1384 MSIAfterburnerSetup465Beta4.exe
1384 MSIAfterburnerSetup465Beta4.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1384	MSIAfterburnerSetup465Beta4.exe
1384	MSIAfterburnerSetup465Beta4.exe

C:\Users\Admin\AppData\Local\Temp\MSIAfterburnerSetup465Beta4.exe
"C:\Users\Admin\AppData\Local\Temp\MSIAfterburnerSetup465Beta4.exe"
1⤵
- Loads dropped DLL
PID:1384

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy3E9.tmp\LangDLL.dll
Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
\Users\Admin\AppData\Local\Temp\nsy3E9.tmp\nsDialogs.dll
Filesize
9KB

MD5
ca5bb0ee2b698869c41c087c9854487c

SHA1
4a8abbb2544f1a9555e57a142a147dfeb40c4ca4

SHA256
c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324

SHA512
363a80843d7601ba119bc981c4346188f490b388e3ed390a0667aaf5138b885eec6c69d4e7f60f93b069d6550277f4c926bd0f37bc893928111dc62494124770

Download Submit