a53cb3bf999ead4c133fb1c782b9c302f8a30dea42514726be750c35ad8d4779

Analysis

max time kernel
145s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 00:52

Target

a53cb3bf999ead4c133fb1c782b9c302f8a30dea42514726be750c35ad8d4779.exe
Size

51KB
MD5

6fee9a6d082d1d5545864d54f804ef50
SHA1

f5bcd7f14992b789ca5a4c0d752342e0d73ee187
SHA256

a53cb3bf999ead4c133fb1c782b9c302f8a30dea42514726be750c35ad8d4779
SHA512

562b8544d5f2947f7c79b5a40da2e6409d7e4920e52b84ee408ca7f37fb95b2709fbedb4cee023fa1ff38ac52664bfb8eb753586c690cb28fd81ccde1f377b0f
SSDEEP

768:l1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJYPVN53aJQh2I4aCaeuf06j4YFopTK:TQpQ5EP0ijnRTXJIVN5cQ8IvCduMBK

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2724	a53cb3bf999ead4c133fb1c782b9c302f8a30dea42514726be750c35ad8d4779.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a53cb3bf999ead4c133fb1c782b9c302f8a30dea42514726be750c35ad8d4779.exe
"C:\Users\Admin\AppData\Local\Temp\a53cb3bf999ead4c133fb1c782b9c302f8a30dea42514726be750c35ad8d4779.exe"
1⤵
- Loads dropped DLL
PID:2724

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsdC26C.tmp\1054f154-ae5a-4716-ac6f-3ccd937f34e9.dll

Filesize
20KB

MD5
51550a2595ce0f933dc6b11aa1b27981

SHA1
ae743b5c728d057b4817fa5795b30901a7f3d9f7

SHA256
47e3dd701f46ba18076316886f064577093a71b33165ca554d035c98438b1178

SHA512
f43d10869ced39a5ed6399683e9bafae9e7da4620df58c8bde8052c02a3286e3109dca14d1749a985c9e71fb67d4419678c98885075fc4c6110565a0620c255c

Download Submit