27c4978e1b34cf460b1b66f32227a5a61b13f0c1d3b4467c9942291ef636549e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 19:35

Target

27c4978e1b34cf460b1b66f32227a5a61b13f0c1d3b4467c9942291ef636549e.exe
Size

15.5MB
MD5

3a6e9b1556b60df844ea26661f1e701c
SHA1

6c607fed2850bcea44b277c4059fc3fe7fe47983
SHA256

27c4978e1b34cf460b1b66f32227a5a61b13f0c1d3b4467c9942291ef636549e
SHA512

4e3df3e03ab5900f067e0d397b88323bbcbfd9c810e96d60a1b8dcb10d2ebf70edde39c3844e3515130fe8228c87d1310b37f98796b3db1773d2fd23eafe68ad
SSDEEP

393216:1XvNvptbzerSXYKT1h9kTDsMUQ8C2kOtkg2AHZYN5j:1NvTQGYKTdkTDF8fnkNAHZYNx

Score

7^/10

Loads dropped DLL 3 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\27c4978e1b34cf460b1b66f32227a5a61b13f0c1d3b4467c9942291ef636549e.exe
"C:\Users\Admin\AppData\Local\Temp\27c4978e1b34cf460b1b66f32227a5a61b13f0c1d3b4467c9942291ef636549e.exe"
1⤵
- Loads dropped DLL
PID:864

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsoB97.tmp\AsAdmin.dll

Filesize
44KB

MD5
fd09b08a757c87f19ef9143b839a0db7

SHA1
281d558ad5df325565243b137837ed4cd058bda0

SHA256
9dfdb98885cb16cbe859e1d7b920d2a8fe68cde68620de2abe57a80ecd6d8ca0

SHA512
f067c304701f30b980dd031c2c5f0603a991603b327f584c2dc6dd9c838d1adb400cea827e55ce40416dfc45206addb65eb7d23389bd82382ceba24074e0c61a

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB97.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB97.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download