4988f380d6abfe6fa402c71adeaa7ef182b03c54373ec063bb85f2bcc05076ab

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-10-2022 22:09

Target

4988f380d6abfe6fa402c71adeaa7ef182b03c54373ec063bb85f2bcc05076ab.exe
Size

19.5MB
MD5

2657fe80f11444f2b9b27e4b98b96c4b
SHA1

debcbd6de9176784f37a9575c2e18f07eaae1b19
SHA256

4988f380d6abfe6fa402c71adeaa7ef182b03c54373ec063bb85f2bcc05076ab
SHA512

6c855ae667464be81ea0dbf12ddaf9f944818dc10ea9b5bea2ff29ce1e8e01648f4e54a3897ed5fd11b59919251ae186328a435463ae91dc99053550f6a590d9
SSDEEP

393216:wYLFfI/9AEuzC/7OLWnNVeM2PL6fbqzRDIS5/xg8e96H2bWVa3:wdOEuzCzUz6jSRDISx9A6UWq

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
536	4988f380d6abfe6fa402c71adeaa7ef182b03c54373ec063bb85f2bcc05076ab.exe
536	4988f380d6abfe6fa402c71adeaa7ef182b03c54373ec063bb85f2bcc05076ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\4988f380d6abfe6fa402c71adeaa7ef182b03c54373ec063bb85f2bcc05076ab.exe
"C:\Users\Admin\AppData\Local\Temp\4988f380d6abfe6fa402c71adeaa7ef182b03c54373ec063bb85f2bcc05076ab.exe"
1⤵
- Loads dropped DLL
PID:536

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsoE053.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE053.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
memory/536-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download