7e39dcd15307e7de862b9b42bf556f2836bf7916faab0604a052c82c19e306ca

Analysis

max time kernel
47s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/10/2022, 00:09

Target

7e39dcd15307e7de862b9b42bf556f2836bf7916faab0604a052c82c19e306ca.dll
Size

571KB
MD5

f68aa4c92dd30bd5418f136aaf6c07d6
SHA1

5bb804153029c97fe23517ae5428a591c3c63f28
SHA256

7e39dcd15307e7de862b9b42bf556f2836bf7916faab0604a052c82c19e306ca
SHA512

1aa9285d79645d5d2d67ea9cf082c0e7499c4b68a04b0638aec889b477b5f2fc5494c5a10c2ed5ffd0de6139ff16f88806c87cda3da1a7c34bdeadffefc00ab4
SSDEEP

12288:vgMiaOT5Y6FrXlYYZvEV3DA7gXZrJTiNRm0lBHX:YaOlYGXZvEJ02Zgy0lB

Score

8^/10

Blocklisted process makes network request 5 IoCs

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\NvTmRep_CrashReport2_{F2FE1952-0186-36D3-AAHC-B80CA35AH5B6}.job	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1972	rundll32.exe
1972	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1972	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1972 wrote to memory of 2028	1972	rundll32.exe	28
PID 1972 wrote to memory of 2028	1972	rundll32.exe	28
PID 1972 wrote to memory of 2028	1972	rundll32.exe	28
PID 1972 wrote to memory of 2028	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e39dcd15307e7de862b9b42bf556f2836bf7916faab0604a052c82c19e306ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e39dcd15307e7de862b9b42bf556f2836bf7916faab0604a052c82c19e306ca.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C nltest /domain_trusts > C:\ProgramData\AF32BC.BTFA
    3⤵
    PID:2028

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1972-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download