3b61757c276c9f823c8d49f5322338891335c6ea17649ba0b39e36237d5d399d | Triage

Submit
Reports

Overview

overview

Static

static

3

8200755cbe...33.exe

windows7-x64

8

8200755cbe...33.exe

windows10-2004-x64

8

29c7e87350...5b.exe

windows7-x64

1

29c7e87350...5b.exe

windows10-2004-x64

1

49cccd30a5...90.exe

windows7-x64

1

49cccd30a5...90.exe

windows10-2004-x64

1

b17911ddea...82.exe

windows7-x64

1

b17911ddea...82.exe

windows10-2004-x64

1

02ca4397da...51.exe

windows7-x64

1

02ca4397da...51.exe

windows10-2004-x64

1

022aeb126d...74.exe

windows7-x64

9

022aeb126d...74.exe

windows10-2004-x64

9

smb-7teux2sm.exe

windows7-x64

9

smb-7teux2sm.exe

windows10-2004-x64

9

smb-onil0o36.exe

windows7-x64

9

smb-onil0o36.exe

windows10-2004-x64

9

malware-sa...ab.exe

windows7-x64

malware-sa...ab.exe

windows10-2004-x64

malware-sa...1).exe

windows7-x64

6

malware-sa...1).exe

windows10-2004-x64

6

malware-sa...n.xlsx

windows7-x64

1

malware-sa...n.xlsx

windows10-2004-x64

1

Analysis

max time kernel
138s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 07:00

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe

Resource

win7-20231215-en

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe

Resource

win10v2004-20231222-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral3

Sample

29c7e87350cb03428fc108b03856095b.exe

Resource

win7-20231129-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

29c7e87350cb03428fc108b03856095b.exe

Resource

win10v2004-20231222-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

49cccd30a564410d1f9bbce89fa15890.exe

Resource

win7-20231129-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

49cccd30a564410d1f9bbce89fa15890.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

b17911ddeab973db51362721c940d882.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

b17911ddeab973db51362721c940d882.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

02ca4397da55b3175aaa1ad2c99981e792f66151.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

02ca4397da55b3175aaa1ad2c99981e792f66151.exe

Resource

win10v2004-20231222-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

022aeb126d2d80e683f7f2a3ee920874.exe

Resource

win7-20231215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

022aeb126d2d80e683f7f2a3ee920874.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

smb-7teux2sm.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

smb-7teux2sm.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

smb-onil0o36.exe

Resource

win7-20231215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

smb-onil0o36.exe

Resource

win10v2004-20231215-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

malware-samples-master/Ransomware/Grandcrab/grandcab.exe

Resource

win7-20231215-en

gandcrab backdoor ransomware

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral18

Sample

malware-samples-master/Ransomware/Grandcrab/grandcab.exe

Resource

win10v2004-20231222-en

gandcrab backdoor ransomware

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral19

Sample

malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe

Resource

win7-20231215-en

bootkit persistence

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe

Resource

win10v2004-20231215-en

bootkit persistence

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx

Resource

win7-20231129-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx

Resource

win10v2004-20231215-en

windows10-2004-x64

5 signatures

150 seconds

Report Analysis Logs

General

Target

smb-onil0o36.exe
Size

64KB
MD5

1877eded2f4a8c06ab480faa42d81969
SHA1

848910b3a6fd70e3941a3f0499c73b99c2c79396
SHA256

e9068c65d9d42582ea3874bc0a388936dbbe4bc4fc89432db01c0995146c18d2
SHA512

605f2d78d5edc809ec201fa5f2096955bd8f7c6adf5b0a0241dce10cb4b89aecd65eed352705a71f191aae3f18d2b371b1a595d0f4ef4ba1c0da4893c25e81ea
SSDEEP

768:2W8+9FisiTZdz4HLCLTRnVuwGiJTPpfl6dW6WsyqAgg8RCW+jl2WDMrL4:2sisiTuLCLTRVuwZp5l/lsyqFg8B+RP

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (10596) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Processes

C:\Users\Admin\AppData\Local\Temp\smb-onil0o36.exe
"C:\Users\Admin\AppData\Local\Temp\smb-onil0o36.exe"
1⤵
PID:1820

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

© 2018-2024

Terms | Privacy