ef28fb08c2e286f188bce0785ac3406ae05f952385356dded82b87393794cd46

Analysis

max time kernel
23s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 22:37

Target

ef28fb08c2e286f188bce0785ac3406ae05f952385356dded82b87393794cd46.exe
Size

621KB
MD5

ef25e336beb7b3773fb5a54ff1d88aba
SHA1

21d6ae067de2dbf7b79e0e29d02c82e078ce2bff
SHA256

ef28fb08c2e286f188bce0785ac3406ae05f952385356dded82b87393794cd46
SHA512

bd2e7b1544a556f943494e4330e4e09dc0ab9f60e2416d2a305c423b88b720f1b1b949de42094238e8cbb52100d290af530bf502b4d19979951c81e63f4f62dc
SSDEEP

12288:qG61oKknc673+IpzY3MgX68oC53a+djqb5lEiu6AYD:b6kz71eMgOCNaz5tu6hD

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
4308	ef28fb08c2e286f188bce0785ac3406ae05f952385356dded82b87393794cd46.exe
4308	ef28fb08c2e286f188bce0785ac3406ae05f952385356dded82b87393794cd46.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ef28fb08c2e286f188bce0785ac3406ae05f952385356dded82b87393794cd46.exe
"C:\Users\Admin\AppData\Local\Temp\ef28fb08c2e286f188bce0785ac3406ae05f952385356dded82b87393794cd46.exe"
1⤵
- Loads dropped DLL
PID:4308

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsxA89A.tmp\System.dll

Filesize
11KB

MD5
fc90dfb694d0e17b013d6f818bce41b0

SHA1
3243969886d640af3bfa442728b9f0dff9d5f5b0

SHA256
7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

SHA512
324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA89A.tmp\inetc.dll

Filesize
24KB

MD5
1fc1fbb2c7a14b7901fc9abbd6dbef10

SHA1
4d9ed86f31075a3d3f674ff78f39c190a4098126

SHA256
4f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e

SHA512
76d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2

Download Submit