81f6772805abe6e8176613ba8a2e7cf69e1f5ac30335038f831721251db587da

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 04:09

Target

81f6772805abe6e8176613ba8a2e7cf69e1f5ac30335038f831721251db587da.exe
Size

3.6MB
MD5

f92518ed30f304e00683b34b225707aa
SHA1

82fb0ef7a311b60d15c8a9d8f88611016faca247
SHA256

81f6772805abe6e8176613ba8a2e7cf69e1f5ac30335038f831721251db587da
SHA512

958be1d8ce9d300917b2ce3676c5acfc10ca56692aa6b8428d71b692439c265dbe7635c26f3a9d483af2d5a016df2e797cf6a305eca11c3b71ead110a41ea268
SSDEEP

98304:Y7FmefyT78k3MMauzRT0TXo74BpFieVHJwG4wb/Sj11lDrDqBX7:Y7G8k8M14BpFFHJw5wM1lDHi7

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4488	81f6772805abe6e8176613ba8a2e7cf69e1f5ac30335038f831721251db587da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\81f6772805abe6e8176613ba8a2e7cf69e1f5ac30335038f831721251db587da.exe
"C:\Users\Admin\AppData\Local\Temp\81f6772805abe6e8176613ba8a2e7cf69e1f5ac30335038f831721251db587da.exe"
1⤵
- Loads dropped DLL
PID:4488

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsx8FD3.tmp\InstallOptions.dll

Filesize
14KB

MD5
fa5beae80dba254fb6c21b58265f5310

SHA1
f2f776611dbbb157b151aa744a7e0be1d4b8c079

SHA256
34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269

SHA512
7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538

Download Submit