b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f

Analysis

max time kernel
53s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 06:55

Target

b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe
Size

98KB
MD5

88766e5da236b7f682383af382a2fc4a
SHA1

fc041fbc1a267077bede4d582bf839b3a017bedc
SHA256

b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f
SHA512

3ce6830ca1db67375e7b547235a3a6ac47721c599a0cdca3c653a8b76b7b159b9e7ddd968673ed1e67e2e7f50149f7bc375062160bf52499d88cee4a684c9207
SSDEEP

1536:zQpQ5EP0ijnRTXJBwpIu9MEddtBpwED+qGXgHkXxlJTqD9UfOv8/xdv3:zQIURTXJBoddtBpwWGXgEhlFk8/xdP

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1984	b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe
1984	b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe
"C:\Users\Admin\AppData\Local\Temp\b68729169c5a7e1f50a3d54a6c2c534e785bbdea1522056f416c3f408a7aef5f.exe"
1⤵
- Loads dropped DLL
PID:1984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsjE025.tmp\Registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE025.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/1984-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download