dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356

Analysis

max time kernel
117s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 06:10

Target

dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe
Size

342KB
MD5

0d7ad95361c0ee5db22d90ba6c881a5b
SHA1

eb3bfdf6df75a97162f0e1751eab4c3d5403c69c
SHA256

dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356
SHA512

4c10f0ffded625488378253eacc6a0bb40c3aad8bc43f80c05c6103d463205a375156e472fd2571610b86aa5df1a74cdf7891d287d3409399ccc45c293919986
SSDEEP

6144:dTfFDbRnOT4t5JpGSB/GSVJ/nKWUxPYRjeizR0JM70kU4TFdL5te7k:T5Oby/XX/nKJx9izR0uZVe7k

Score

4^/10

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SCC\Knob.dll	dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe
File opened for modification	C:\Program Files (x86)\SCC\Knob.dll	dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe
File created	C:\Program Files (x86)\SCC\SCC.exe	dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe
File opened for modification	C:\Program Files (x86)\SCC\SCC.exe	dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe
File opened for modification	C:\Program Files (x86)\SCC	dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe
File created	C:\Program Files (x86)\SCC\__tmp_rar_sfx_access_check_240565000	dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe
"C:\Users\Admin\AppData\Local\Temp\dbbd95efca4d14212c083fab4e6d08011e372a35fc14e6fb3865989370ba8356.exe"
1⤵
- Drops file in Program Files directory
PID:4084

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact