7eb5385126385a328356946ef55557a7e98155c08ccd5ade43503d9f4ad59d01

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 13:21

Target

INQUIRY.exe
Size

334KB
MD5

8ec365b813648c10fb68b1ba7489a40f
SHA1

54fcbb1d93a9329348df39b61895444f5f2823e1
SHA256

7eb5385126385a328356946ef55557a7e98155c08ccd5ade43503d9f4ad59d01
SHA512

97060f9638e505d6d93fbfda40978568d4754fd69761b0f7dbf46fec799b0593679661813432bab4f8f1ca634cd2fc62de33befeacaf3e19809c4ba923abbb71
SSDEEP

6144:GlJZfNZoF5qMwYHg5yVxPvJ5hHzhGygMlY21A0nk1loT:Gl4FBvtvPhHky+1l8

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4332	INQUIRY.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Arteriogrammes\Anaglyphoscope\Troldkrabberne.Fis	INQUIRY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nseE006.tmp\System.dll

Filesize
11KB

MD5
fc90dfb694d0e17b013d6f818bce41b0

SHA1
3243969886d640af3bfa442728b9f0dff9d5f5b0

SHA256
7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

SHA512
324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

Download Submit
memory/4332-133-0x0000000004AC0000-0x0000000004BC1000-memory.dmp

Filesize
1.0MB

Download
memory/4332-134-0x0000000004AC0000-0x0000000004BC1000-memory.dmp

Filesize
1.0MB

Download