e1950bbba7fac38fa354668e98c4028281f479cde828b8694f07d54fe137fe30

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 21:28

Target

e1950bbba7fac38fa354668e98c4028281f479cde828b8694f07d54fe137fe30.exe
Size

51KB
MD5

a0c11a61f8217701fd881ac932b6ebe0
SHA1

b3419029ede6f0659aab383620854e975f180869
SHA256

e1950bbba7fac38fa354668e98c4028281f479cde828b8694f07d54fe137fe30
SHA512

b925a789f1632f3686a5ebf4323f1d3101e49ce1dea4108a6fa86aeab513b451241f8836dcbc7550c9207e49565349d2c082c37159ce19630ca94604f74689de
SSDEEP

1536:TQpQ5EP0ijnRTXJIVN5cQ8IvCHpJkCeBYM:TQIURTXJI+Q1vCHpJkCA

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
340	e1950bbba7fac38fa354668e98c4028281f479cde828b8694f07d54fe137fe30.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e1950bbba7fac38fa354668e98c4028281f479cde828b8694f07d54fe137fe30.exe
"C:\Users\Admin\AppData\Local\Temp\e1950bbba7fac38fa354668e98c4028281f479cde828b8694f07d54fe137fe30.exe"
1⤵
- Loads dropped DLL
PID:340

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsiA8E.tmp\185ca76f-7a62-4ab6-813a-5fe43e191320.dll

Filesize
20KB

MD5
56832d25535f5a455423226f99550c8a

SHA1
d6cf7b792194ac541ff1f9f3af2a2eaea1fd8e69

SHA256
ac9bac3ba90e1e2cb237f5676ec8b5934f8803762ab3be679ce1bbea19b4369a

SHA512
44bd9ad9c6ca446818918179a33b7e43e875681db9aaa8d28eda0ad5701d43b761197fa3a2565702a1097fd960c13e5a0927141ed72973d7fa3e372ca25bbb98

Download Submit
memory/340-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download