c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3

Analysis

max time kernel
82s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2022 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3.exe
Size

16.9MB
MD5

221c47feeba9b88d4ca101f16f2941cc
SHA1

b99282516fe3cba7cf2a217efcc73993aa1b7078
SHA256

c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3
SHA512

5b61265748067623b1ee7160cba8634c26222ceb08c3426648d4298a61ed90f87fb8988eb5493d8b011b1aea6ff3e8e9406a442f479b2375c1a573c5dc614f41
SSDEEP

393216:vhyrYlbasIH6aJQ/Rp58o/4RlMzu4LhPq64xkYgA5pkA0lEo:vheybC62Q/Rpxgv4Oxk8pkAuEo

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2040	c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3.exe
2040	c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3.exe
2040	c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3.exe
2040	c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3.exe
"C:\Users\Admin\AppData\Local\Temp\c050ed6b1e3f70791324a9be655acda74a2450cb3ab01293d96a36c230b84fc3.exe"
1⤵
- Loads dropped DLL
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsr985F.tmp\AdvSplash.dll

Filesize
6KB

MD5
b6c37df9463f46ab5635fbc79fa22080

SHA1
a7a6d282a4b5a0a27ac22b737542b76cfd43bd9b

SHA256
c065a25359e2114076b84340b5e811f7291fb8dab1985821e6631fcee174ce22

SHA512
be38a8a33b307e6097fb59979c404f04543e3855dadfb2341c1a3a57cddc945dc92c445882b9cb352839ad48cfe4d4d57740768492ae786de8d59b5daf5f50f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr985F.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr985F.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr985F.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
memory/2040-136-0x00000000022F1000-0x00000000022F3000-memory.dmp

Filesize
8KB

Download