Analysis

  • max time kernel
    125s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    11-04-2023 09:06

General

  • Target

    tmp.exe

  • Size

    5.8MB

  • MD5

    10d7219a30074131e27d9a148848da7b

  • SHA1

    703212aa93205b921d95a16f773ae7f682687a62

  • SHA256

    892b64ab07d6d151bcea38143922eab7385b01b7a8d7c44a445611a6c16061d8

  • SHA512

    ceb901bc5c23e7b6c40c9283ee5dd35be4f7adb795c574433f2325ee7394f233ef150bfe04764e0c63ed9a116771cd6caf9b4068c1da5a62281218d4ccf02b37

  • SSDEEP

    98304:nYICI59QVxbgXmkFfZT5/J1xkPmzc9Ll9ccx/jlvSfTXH21+JTjXI8eMelSUKFxY:Ya8xamkNV5/pkPmz697LlKfTXRR48eMo

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1616

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd46C3.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    a1cd3f159ef78d9ace162f067b544fd9

    SHA1

    72671fdf4bfeeb99b392685bf01081b4a0b3ae66

    SHA256

    47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

    SHA512

    ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

  • \Users\Admin\AppData\Local\Temp\nsd46C3.tmp\System.dll

    Filesize

    11KB

    MD5

    bf712f32249029466fa86756f5546950

    SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4