b2135c09fbf45cc23314b0daa3fca699276f6103a90db0e11f9bcc31eee47477

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 18:49

Target

b2135c09fbf45cc23314b0daa3fca699276f6103a90db0e11f9bcc31eee47477.exe
Size

16.3MB
MD5

b48626a1216ea6c59e20a72fc11f30a7
SHA1

f02dee377746d088b79fd9ec0f4b5b162c414106
SHA256

b2135c09fbf45cc23314b0daa3fca699276f6103a90db0e11f9bcc31eee47477
SHA512

c6123fedb27ae7183e8ddffeac216a3e0a6a18d510716312493a1948b88fb7a3798136c21d472c975913b8a7c5454fb71b7311e46e9a5bdcdf67d83c43cb8ff0
SSDEEP

196608:/7K8f4BH0MdwjWACeSxcXjnPgeurlSdDLcSMLgrl+33S8yod54mH8r3wq6jzL2vZ:uM60SPewcX+mESMwl8eyH8wQw9lr3cnT

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1736	b2135c09fbf45cc23314b0daa3fca699276f6103a90db0e11f9bcc31eee47477.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b2135c09fbf45cc23314b0daa3fca699276f6103a90db0e11f9bcc31eee47477.exe
"C:\Users\Admin\AppData\Local\Temp\b2135c09fbf45cc23314b0daa3fca699276f6103a90db0e11f9bcc31eee47477.exe"
1⤵
- Loads dropped DLL
PID:1736

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsoE56.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
memory/1736-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download