4756b8a9f5c2bfe06ac564ac017569e427b963235f50f63e4f2a6f58677419c0

Analysis

max time kernel
130s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sono_SocialRibbons_185014_100611223352.exe
Size

91KB
MD5

4342227e249bc51e04089f4dc9745c53
SHA1

fd3c3ea27696aec6dcbc21d960f2f41d19065e89
SHA256

06dc520f9f7208fb85f86f41cb48cbbf0f0c7fc4528bea7389d3af61c2126aeb
SHA512

843ea7176b9c54824769ca9bdbcbaf572842e9c39ea949feb3630a37abcbd2732b2dbf79ad2aaca87272ee8b41cb8d3aed8f1813188bb9f47b8f32796f1fab91
SSDEEP

1536:BpgpHzb9dZVX9fHMvG0D3XJv4Romu/pF7V/Bf20JzvxGT+KGWhAa7sTjb:7gXdZt9P6D3XJv45AFJ/BO0JLxDKGWhm

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2800	sono_SocialRibbons_185014_100611223352.exe
2800	sono_SocialRibbons_185014_100611223352.exe
2800	sono_SocialRibbons_185014_100611223352.exe
2800	sono_SocialRibbons_185014_100611223352.exe
2800	sono_SocialRibbons_185014_100611223352.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Setup Support for Social Ribbons\uninst.exe	sono_SocialRibbons_185014_100611223352.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\sono_SocialRibbons_185014_100611223352.exe
"C:\Users\Admin\AppData\Local\Temp\sono_SocialRibbons_185014_100611223352.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsv6E2C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6E2C.tmp\inetc.dll

Filesize
20KB

MD5
7569b23f19a0f5cb4c1d3b30a296c4bb

SHA1
c5f3546b3c795e46445393960694a2341692ddc7

SHA256
615bf32e15aaa8d58832df2298f75dd2b29ea5f25bf152c99630315cb618a31a

SHA512
11663bf180f9540ad247957b6793f8afd1b4e66f3b692b4ad05735f07459dd524571245928c40e26e3de691472508f5632fcd4add1eebad559d504eca32c08a9

Download Submit