9e614cbac9f674710de965d9847ace29127d71dc1875e48517f4abce0e324400

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 09:58

Target

tmp.exe
Size

25.0MB
MD5

8499d288543591f172e5f913a765ab25
SHA1

1aad0d141c9e9ca6e388fc1deaf5edac23893cec
SHA256

9e614cbac9f674710de965d9847ace29127d71dc1875e48517f4abce0e324400
SHA512

2af6e6115a4719de3ef2cc8bd3e68fd51b4297879bcf2c09326506ff1097c4f1bc781c9d21f95d17abf13d034bb22b356c46de4b91ac4c94074ff8f52c010360
SSDEEP

786432:AgS7PzmDbPWFQsAhRoyKxg4XOqtgK4V8ubp1lsg:Fq8bOeRFP4L+K3Kb

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1340	tmp.exe
1340	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
PID:1340

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst2FAB.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
\Users\Admin\AppData\Local\Temp\nst2FAB.tmp\nsDialogs.dll

Filesize
9KB

MD5
13b6a88cf284d0f45619e76191e2b995

SHA1
09ebb0eb4b1dca73d354368414906fc5ad667e06

SHA256
cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911

SHA512
2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e

Download Submit
memory/1340-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download