5d5430c6f1f102d0eca6d7dd4d9b057a45a03b62da90238cf4c26b84da1f19ce

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/10/2022, 03:29

Target

5d5430c6f1f102d0eca6d7dd4d9b057a45a03b62da90238cf4c26b84da1f19ce.exe
Size

6.6MB
MD5

941d71e2743fd40b70d0d17c9cbfcfa9
SHA1

67596ff6bd47ef840f52351b83282dc9513c6edb
SHA256

5d5430c6f1f102d0eca6d7dd4d9b057a45a03b62da90238cf4c26b84da1f19ce
SHA512

0852ea3496ed1102afacb305c945b7aeba01b70a342ba880e7eab6193c35dd5f19efbe31c0f3a98a5c845ec1dac59f2f2995157c89e102d6dfe1a2e2a5bf962d
SSDEEP

196608:b+Vu+uDzvohaRAm5wv1oQ1TgqPXdgo/M1g5:b+VGqZnV34g5

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
968	5d5430c6f1f102d0eca6d7dd4d9b057a45a03b62da90238cf4c26b84da1f19ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5d5430c6f1f102d0eca6d7dd4d9b057a45a03b62da90238cf4c26b84da1f19ce.exe
"C:\Users\Admin\AppData\Local\Temp\5d5430c6f1f102d0eca6d7dd4d9b057a45a03b62da90238cf4c26b84da1f19ce.exe"
1⤵
- Loads dropped DLL
PID:968

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nstF098.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
memory/968-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download