cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/04/2023, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120.exe
Size

16.6MB
MD5

1669786cabab66120f2b426a19cf1d5d
SHA1

056fe12600e63f14811f74df1a679d5cb37802b2
SHA256

cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120
SHA512

ef99a26f763e54fe7f30b8906333d43c29dc55d2819381bd4ed0dd6e6e5d327ce4ddcf6f71246379bcf8570dcad2e4b051eaf19009bb32005c2c1c24c6ec7950
SSDEEP

393216:cSpK8559igPyb4d3N1p6+NxWQaEHEZYiEX2zO869QpLlI5q:5x5k2ybY3N1p8Q3SAwLlI5q

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
928	cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120.exe
928	cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120.exe
928	cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120.exe
928	cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120.exe
1260	Process not Found
1260	Process not Found
1260	Process not Found
1260	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x000500000001a420-215.dat	nsis_installer_2

C:\Users\Admin\AppData\Local\Temp\cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120.exe
"C:\Users\Admin\AppData\Local\Temp\cca51d9716f629c821974ed676f5571bd184f429b8809114cb4ba320619c9120.exe"
1⤵
- Loads dropped DLL
PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd39F7.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\pc\ÁùµÀ.exe

Filesize
633KB

MD5
2da5979e5549ed0296abb641a4aa27a3

SHA1
e714a885b14a19dc7d6111e7ec4af9bf4361b66d

SHA256
b66e5894ff3b9d584ba936d27dc00709e363a8844a95bbba96ad82c14014fc5f

SHA512
f043551364a7c67b52f495ac2724df192f2b261e64f01957f0183a1158ef66a66eeda8c79d3b4ed0f9f10ce5b2740f6d84213d773f5d2e557065b382629cbb03

Download Submit
\Users\Admin\AppData\Local\Temp\nsd39F7.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\pc\ZUninstall.exe

Filesize
49KB

MD5
5c41e162fb092673fda45f60911bd852

SHA1
f511a981bb86bfbc83a1a675e20e4d5b069edbd7

SHA256
f26aeea39934f65e439aaf2d3a8b20129f4c78e9639b7a1cbd4cb15837668b4c

SHA512
ae30cff3ced58f422d8672ae6565c23041c762415674e4d35c3f4323167f8fdd9ca98ae309d0542554c40d35da5918c00f19fe2602711712293e36c684a5c8fc

Download Submit
\Users\Admin\AppData\Local\Temp\pc\ÁùµÀ.exe

Filesize
633KB

MD5
2da5979e5549ed0296abb641a4aa27a3

SHA1
e714a885b14a19dc7d6111e7ec4af9bf4361b66d

SHA256
b66e5894ff3b9d584ba936d27dc00709e363a8844a95bbba96ad82c14014fc5f

SHA512
f043551364a7c67b52f495ac2724df192f2b261e64f01957f0183a1158ef66a66eeda8c79d3b4ed0f9f10ce5b2740f6d84213d773f5d2e557065b382629cbb03

Download Submit
\Users\Admin\AppData\Local\Temp\pc\ÁùµÀ.exe

Filesize
633KB

MD5
2da5979e5549ed0296abb641a4aa27a3

SHA1
e714a885b14a19dc7d6111e7ec4af9bf4361b66d

SHA256
b66e5894ff3b9d584ba936d27dc00709e363a8844a95bbba96ad82c14014fc5f

SHA512
f043551364a7c67b52f495ac2724df192f2b261e64f01957f0183a1158ef66a66eeda8c79d3b4ed0f9f10ce5b2740f6d84213d773f5d2e557065b382629cbb03

Download Submit
\Users\Admin\AppData\Local\Temp\pc\ÁùµÀ.exe

Filesize
633KB

MD5
2da5979e5549ed0296abb641a4aa27a3

SHA1
e714a885b14a19dc7d6111e7ec4af9bf4361b66d

SHA256
b66e5894ff3b9d584ba936d27dc00709e363a8844a95bbba96ad82c14014fc5f

SHA512
f043551364a7c67b52f495ac2724df192f2b261e64f01957f0183a1158ef66a66eeda8c79d3b4ed0f9f10ce5b2740f6d84213d773f5d2e557065b382629cbb03

Download Submit
\Users\Admin\AppData\Local\Temp\pc\ÁùµÀ.exe

Filesize
633KB

MD5
2da5979e5549ed0296abb641a4aa27a3

SHA1
e714a885b14a19dc7d6111e7ec4af9bf4361b66d

SHA256
b66e5894ff3b9d584ba936d27dc00709e363a8844a95bbba96ad82c14014fc5f

SHA512
f043551364a7c67b52f495ac2724df192f2b261e64f01957f0183a1158ef66a66eeda8c79d3b4ed0f9f10ce5b2740f6d84213d773f5d2e557065b382629cbb03

Download Submit
\Users\Admin\AppData\Local\Temp\pc\ÁùµÀ.exe

Filesize
633KB

MD5
2da5979e5549ed0296abb641a4aa27a3

SHA1
e714a885b14a19dc7d6111e7ec4af9bf4361b66d

SHA256
b66e5894ff3b9d584ba936d27dc00709e363a8844a95bbba96ad82c14014fc5f

SHA512
f043551364a7c67b52f495ac2724df192f2b261e64f01957f0183a1158ef66a66eeda8c79d3b4ed0f9f10ce5b2740f6d84213d773f5d2e557065b382629cbb03

Download Submit
\Users\Admin\AppData\Local\Temp\pc\ÁùµÀ.exe

Filesize
633KB

MD5
2da5979e5549ed0296abb641a4aa27a3

SHA1
e714a885b14a19dc7d6111e7ec4af9bf4361b66d

SHA256
b66e5894ff3b9d584ba936d27dc00709e363a8844a95bbba96ad82c14014fc5f

SHA512
f043551364a7c67b52f495ac2724df192f2b261e64f01957f0183a1158ef66a66eeda8c79d3b4ed0f9f10ce5b2740f6d84213d773f5d2e557065b382629cbb03

Download Submit