a61727ef3864630013af42d6011b1e8ed1a4104a4c27f25cb3a6a46fcd486305

Analysis

max time kernel
128s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 14:41

Target

a61727ef3864630013af42d6011b1e8ed1a4104a4c27f25cb3a6a46fcd486305.exe
Size

236KB
MD5

e2cd71866f558e96d47fad8c531a1614
SHA1

4090f7a651616dd3aa0f6f82967fcda907874200
SHA256

a61727ef3864630013af42d6011b1e8ed1a4104a4c27f25cb3a6a46fcd486305
SHA512

abe8f1a52c5a8fdd3e73964b60f0ae7bf004177af25f4f4fbae6253f52a485eb4258121e34a8fe32255cf5a74c484372981d7adbc85b80335d0ade8e255f6063
SSDEEP

6144:MNeZ67BzUxW0pA+lmIvVV8DXnIIkWiEHVIRrsP2/mFJ:MNoW0Llt0DXzHRVIKPhFJ

Score

7^/10

Loads dropped DLL 3 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a61727ef3864630013af42d6011b1e8ed1a4104a4c27f25cb3a6a46fcd486305.exe
"C:\Users\Admin\AppData\Local\Temp\a61727ef3864630013af42d6011b1e8ed1a4104a4c27f25cb3a6a46fcd486305.exe"
1⤵
- Loads dropped DLL
PID:2624

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsc8DBF.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc8DBF.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc8DBF.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit