6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f

Analysis

max time kernel
25s
max time network
136s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 01:53

Target

6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f.exe
Size

73KB
MD5

44fb34b888b443527f7b13920a39df57
SHA1

cd9941db938ca38ec566e1b6e8cdb936f8fa870c
SHA256

6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f
SHA512

5eb9fdf13a7056d0204eee48a18c05bf65a621b0b3b7f98cd5e0d0ae892d7472862d0e9db6ac838d4792f1b03964c78d38372f23e0b4975ef6c62d2fe3f0654d
SSDEEP

1536:2I0BJ1U34+QsKPlqmw3sSx2bPnpsg0AInO3f2o+:+KL0xw3sSx2bPnpGznO3fj+

Score

7^/10

Loads dropped DLL 3 IoCs

pid	Process
904	6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f.exe
904	6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f.exe
904	6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f.exe
"C:\Users\Admin\AppData\Local\Temp\6ad2a613e9bd291f900f2495597c1ce54dde51feeeaf2a254eec88d4b1fa8e9f.exe"
1⤵
- Loads dropped DLL
PID:904

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsd2E14.tmp\NSISdl.dll

Filesize
15KB

MD5
7caaf58a526da33c24cbe122e7839693

SHA1
7687112cb6593947226f8a8319d6e2d0cdef3b11

SHA256
19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

SHA512
aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2E14.tmp\NSISdl.dll

Filesize
15KB

MD5
7caaf58a526da33c24cbe122e7839693

SHA1
7687112cb6593947226f8a8319d6e2d0cdef3b11

SHA256
19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

SHA512
aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2E14.tmp\NSISdl.dll

Filesize
15KB

MD5
7caaf58a526da33c24cbe122e7839693

SHA1
7687112cb6593947226f8a8319d6e2d0cdef3b11

SHA256
19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

SHA512
aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

Download Submit
memory/904-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download