06cf616185c568b408a49c4789ac08993aaa473dcc5f6f310fba75b6d6230d0c

Analysis

max time kernel
0s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bb1722a8fa035428bf1b4ba5875861f.exe
Size

112KB
MD5

0bb1722a8fa035428bf1b4ba5875861f
SHA1

8c6797fbed8445937be7a547316023084a779d7f
SHA256

06cf616185c568b408a49c4789ac08993aaa473dcc5f6f310fba75b6d6230d0c
SHA512

84ca34f7095913cf4da6bbda7382599fcdd0ef805b11e244f9d9fbee16cfdb72ee3fbc757c62b9dcf9301d52c911178e2f9e2f50d012435969b7e011e2c70c4c
SSDEEP

3072:qX7DItrfaocyTgfsqQOlJVeqgKJ+BCIxrmY9MI86:qsaocyLC3gKMJBc6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
824	0bb1722a8fa035428bf1b4ba5875861f.exe
824	0bb1722a8fa035428bf1b4ba5875861f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0bb1722a8fa035428bf1b4ba5875861f.exe
"C:\Users\Admin\AppData\Local\Temp\0bb1722a8fa035428bf1b4ba5875861f.exe"
1⤵
- Loads dropped DLL
PID:824
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://7daystodie.ru/load/0-0-1-7-20
  2⤵
  PID:2664

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6304c0e11a1270617fc74a77bd16e4a0

SHA1
1e00042a62bf44193bb801205ecb571a2e40ffb7

SHA256
93c51a715c1af27a6bd83e35c54a499c4026b4b34d6b5aef0f08e33fb0177fab

SHA512
e65416b577d0f054b3de31cf0e659c9c3c5fea4f892c5d8cc3a76fb5e0bcb697016d77e31b881410d4bbf9a69d6066cfbd0e67a23cb015779646aa5235350991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4611d0642c71fbb331ab627f0b23ca9d

SHA1
b397dc451adeb3c3d53c340f97bf3f0405d95954

SHA256
e9461e5b4d12e69d88f77ed86c58bb6e8e8442328a8cedd9560d4778b8d97f91

SHA512
8de3bb1dd3a1e776ad8aeee95e3f954ee1b6d11cc074f00fe20a484e2683a9a147900e054b688322d99e6502c710ff8f46467e1c9513b701075c660a2621afef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
742dc9103c9c490b8ad693d5cf34042b

SHA1
293c5bed83f62e1d23be964df70eaa02b7b1003b

SHA256
19e5916d2dec7c8cd85dc6d5dd95f0258d1e0ed6762c4ea667e79a2c684e437f

SHA512
626c45f6ab365a5b7b3a15212f8fcc644fcd304b08605868ecb7ec57d62471079cd36eeaab4edd4dc6453ad9190a9cd76f44311003ead3a0b5df1925db606e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6561b3acf7a62013ad50483a5b8bf5a5

SHA1
b34a95d79cd7cad995a5d52e1070c84386fc79c1

SHA256
7a41b2338ccffd4e55b98a43325605530364da7e9b1ed724ac0147fc163195b2

SHA512
157fa3deb4a88b522efc1560516d7edf0acfe61a122d2252b277719de85d36f52e0e144e2978cb624fcd32c2139b103fbc4601379175a36f49f6b68862a11389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48b4a7898f850fe850a9c8fa3c4e446a

SHA1
82419da707339f1e08f6733e4e3fc8d1ff84ed3b

SHA256
8156b810108410d0f1cc0125a7743162f35391773a19949e319471a1efb71592

SHA512
3be21ebd1892e93611a4883d858443824b8adb8049bea51488f2bb19972173b9d6a298cc476748bb2f9578670cbb47a61f74c6ac9fd4322982548c689235132c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f45398cb65baad0caa9aba89b5edbc

SHA1
a5d0e57bd89c267ea7e7d0366022d84bd19c74d0

SHA256
53b441de9389d9cf5556b2034a50aaa7c891b5babd64a20424a5eb63685ee8b9

SHA512
6eb25bb0bcbccd18f9400b09d1a51e93e9e1e0facf4f1ad325f26a6390fc28a86241c06a9441aa2be9857da5a2c971e8d29ce6b11b7fe074d1d3f8f2184266ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b8a0d268e763a3d5543be111c95ad29

SHA1
e639e3656a425aab8bf7d1fe3f253ee0f5ebeece

SHA256
5c4764fcd2fbbe552b9feb9a51a30ae155cde67c09081a86eea6407e484e5888

SHA512
2f7e4b6b824f5dd1f5bcf9ccaf10b73ec84612c9de7f47057b775506d357615f7a26f2a557a9948569928670fd8bc1a70d0c695714a373b7865292608a343ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a36cae963bd999f7ba52065c7938b92

SHA1
4792eed6c95af3b61501add611de0ad3f2d566fc

SHA256
e7c7880542e215aeaac610cfe4159793e9bd7ba39366e2dd882ae21be944699d

SHA512
ff1f009d8dc0d3d4b8462a4e7ff6ce8d48678960729cfeb2e7537ab876ceb6877ba534949b2e2b38c4007a72cea792a9a5df6012d4cab40d940fae946287abbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b968566c6ab3d678c3ea851ccc367cc

SHA1
def3995893d43461144f0e482662735f32de1768

SHA256
786cabdc46911e876b00c18b4646df508ca90c6e15dd6cda0daf2207e15c8de5

SHA512
8bec66cd2f1f1ecff2086facb2f6cc09d24175f16bb7bf5b628cc66f4e7a75fcebc4f72760f865f5fe09340c508e61d4512b9de640f74bfe7da6ef115b5f6219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c0b23a1cbf27fdca80144d3116dca8c

SHA1
12164d0b818bd701f49639cd7f16efd9d3cddb8c

SHA256
8999b4f0fed656f90189a73b632e99e63473127356a0912268d39d5fbe63d9ac

SHA512
cbf664c9c44ad6c6c607776f358f2260fd4831f487213976fb289a912bbb77d3d26e308905cba4882d21e4c0676319ddcc740566484eb2f798c350dd7b51f916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18722225c330ba052d4af72a548d523e

SHA1
c15bbcb194e1fb53a6eb8b277ec0fc47018fd82b

SHA256
18330aedb72396675a3940d304ea58e1e6b60151d769d71ebbdc748786fc3884

SHA512
6e3236abc396f776724e5422fd3e7686fc21ace8dc06ef846d15919f2ef95fca2b14886ae30cc8e92e5d818482dcc0b4eac58df89aefcde804155b43cf1c10ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
481b46d5449af0e0b3d1fcdb6137b8ec

SHA1
9fa3ba1043e9a6886b9b7901eaf7e921448ae388

SHA256
841fa1041510f8a6cdf798cc72bf6800948d0a72334452700dbc8ff2d424c1b8

SHA512
b7cc93bf908f794cd37b00f5ed5f12ea51719891777b548fa345de72e78e32a19c8530b3ab84514ef97cea3e2f34ddc1478bab807d286f486d3b9f4101e03657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b62b54567117c0886e73c34b2736e51

SHA1
7b8025bfabeba35f55999aa4fe9f3858f40ff9b0

SHA256
27982cace8cc1a993df68e2c16b1d0b18e289d3fd73f8650e03803174c954317

SHA512
8cf912a5fb2835750a998bfe34a0d462f35fb6303cbde85eb132de0619b5c3a2b56a213a183aff32977a0bcd9cb61558c12a1ce93859476324876492054cf579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6926ed958088b7f1311ee57073e4e087

SHA1
f6c112a5d7d093b3b6f5b1dc89c3228268eb3d06

SHA256
34d5e5ce30253a69cedf59c76791e574581df44206e0ca772a22bf383f8f6572

SHA512
2d8ecddde3cf87fc2371ca68eeb4bb4356d047d0cde87295d4e44400016b168da5b5064405cd46938988e6f23c691df24c80753daadc10a05ea8bf7bf139fef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a898554cd0e16d2c76a3c463174c4b2b

SHA1
0daa1e04aa65faf74d55f83730a5c4f5caf402b4

SHA256
f7a0b02538c310c39e7f9362a1890e831fbcb2b495a481c7a505b555f6f456ae

SHA512
2d5d816dd3f6f8b9df0436dc1c7fbc3bf88fa62c7f8c93d46238ccbf5e54718d2b379a8fa58522cfaa3ce72b944709b47a57d9f94361768d2144e65cda777dc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98485a64214c9dffa756222bb0b99c39

SHA1
9e505d3b98d8774fb9650b4f1472694ddb897937

SHA256
17c97f430e09b8227daae25340c0df88e42080692e63b57f37cbe77adbabd93c

SHA512
46420992f8cc3916e90d1370a56b6ca2c2c054b8f37feaac5a94a36dc1aa080beef0b1436ab5b9557ea87a627962dabe6227711e8f4efe5651ec84bb9c4142d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
147a12c7e18e683f8826afb1ee44f09c

SHA1
f7a16006ca40f7ac6fef7143cd968a819a0b0bb4

SHA256
7f3e8bac2ce9c6b5374ff2c568b19436e6e266afe1a8e5a3c0bbd03acd20cf18

SHA512
4e8391ce1407185b44844887d68f3ae1b0935cb2db15f9101b862e6779c9a363251f06d2a11e582a9b981fd52320ee314fcdac642a2e798db221a89407f36399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DA3.tmp

Filesize
23KB

MD5
4933802d0434a32943710a519b2246e2

SHA1
457b8e4f55a1df3aca81485dadd70b403981d8ca

SHA256
f668ab0fb1fd6e455210f8f1bb9a21d97140b0618547f40326e8d2609c7efe8b

SHA512
6837d98bfd0ca37d7b8babb062346bac22fc47b8e855015d52e6ee6b2d3c8e398314b698d43287888a9f71bc9a0fc4e7dbbb09c71092aec63847e83948fd3974

Download Submit
\Users\Admin\AppData\Local\Temp\nstD1D.tmp\System.dll

Filesize
5KB

MD5
b50ed6f6782c75f0e8752c56890e6c07

SHA1
ea440b3e7631822b5396e55c92de31ac039c4d64

SHA256
85bfe83f795788ea2c4100f50c5492f3a6532bbc6aa39cab61af6cfc243bdf7e

SHA512
4180b903ef76acadf9c7f3dfcaf0c30ce071117abdc435a8ad0cef4e54f56f1b572905f20a858d92fa95cbce9a88cd7558f05a7ae0ae9353924d166c67b6d2c1

Download Submit
memory/824-12-0x000000006E940000-0x000000006E94A000-memory.dmp

Filesize
40KB

Download
memory/824-11-0x000000006E3C0000-0x000000006E3CD000-memory.dmp

Filesize
52KB

Download
memory/824-10-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download