ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da | Triage

Analysis

max time kernel
10s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
31-01-2022 13:21

Sharing

Report Analysis Logs

General

Target

a75c88bdafcead6c2096d01dc8f2f052.exe
Size

412KB
MD5

a75c88bdafcead6c2096d01dc8f2f052
SHA1

d36d981a34f591eada1df8ea230bbfbdcbd6bf97
SHA256

ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da
SHA512

b8d3d14112e5910d906c74c63d0208ac02e8e29b230d92bef1d7c6098a65c0b7660841a5fcefebaf96edf969cdeda62282cd642d56c63fe711a23ea0112edd41

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

a75c88bdafcead6c2096d01dc8f2f052.exe

pid process

2720 a75c88bdafcead6c2096d01dc8f2f052.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a75c88bdafcead6c2096d01dc8f2f052.exe
"C:\Users\Admin\AppData\Local\Temp\a75c88bdafcead6c2096d01dc8f2f052.exe"
1⤵
- Loads dropped DLL
PID:2720

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsf6551.tmp\pxitlcdz.dll
MD5
606d2bcc416fc37c03e554be57b99395

SHA1
1ef604a21f62cbd9039b5b7dec49d74fcc69aa4c

SHA256
11b98384fa90009836cbbf1798b535759bb166278dd0e855dcef2e851720832b

SHA512
63cea78cece3875a839ca62e82db4d9caef7071af6964421f4cfbcb18299c1a7636c69d759f8e134ad74ab968f98be15b6939a660e3299417276a13dcae5ddde

Download Submit