34898e5eec0c3037dcfeea106c4bf4da901562e27e59392d63be52a38b7d6d5f

Analysis

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 10:50

Target

ORDER_10242022.exe
Size

374KB
MD5

3faa4ffd08670d4a25afb114f85779e1
SHA1

ac64582a2639fc13e3fa80972853b846790dae96
SHA256

34898e5eec0c3037dcfeea106c4bf4da901562e27e59392d63be52a38b7d6d5f
SHA512

102a2d4e3334c44e22dfff51de5cb3e45074efef0f90a070c7c8a0729f4e03436b73e2e6df2ef6f259539c650b8b8e5d35bbab58ac108001f0c3d4dcc0754b00
SSDEEP

6144:xDfeRPX7bCTfg4K4pAuBhBWt1VW0br33a/oBbkS5yGnL6afaHBkClRuVkAs:l4f7YHp5hoQsq8bhSlRis

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4896	ORDER_10242022.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Friturestegs\Uterofixation42.lyr	ORDER_10242022.exe
File created	C:\Windows\uninterspersed\Merkantiliseredes\Taales\Alfanumerisk174.lnk	ORDER_10242022.exe
File opened for modification	C:\Windows\Fonts\Tjenestefrit\Leontine.Gig	ORDER_10242022.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nso92DF.tmp\System.dll

Filesize
12KB

MD5
792b6f86e296d3904285b2bf67ccd7e0

SHA1
966b16f84697552747e0ddd19a4ba8ab5083af31

SHA256
c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

SHA512
97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

Download Submit
memory/4896-133-0x00000000049D0000-0x0000000004AD1000-memory.dmp

Filesize
1.0MB

Download
memory/4896-134-0x00000000049D0000-0x0000000004AD1000-memory.dmp

Filesize
1.0MB

Download