ee68d5b9afa1bb94de51576e7a7810a1e9ea4a830fbf10fd1df8330159a41d2f

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 13:06

Target

ee68d5b9afa1bb94de51576e7a7810a1e9ea4a830fbf10fd1df8330159a41d2f.exe
Size

62KB
MD5

203d4ddcb83928bf3fa3a19500b50820
SHA1

99946cd3badc80a6f4c2d329a5ce6afdad6ec45f
SHA256

ee68d5b9afa1bb94de51576e7a7810a1e9ea4a830fbf10fd1df8330159a41d2f
SHA512

0f62bd1d93ac9c4029f6d93d207d9784f51c9ae6af7a6be900ad362aa340cca219ffbde11b9cbc13cb173499d47e54f17389f47c3e9f551bd612879df74dbcb9
SSDEEP

1536:uGarUa6LowvuhdNYh2Gf9rg6hzGPnJCw1H8kPA1USl2+:I5BuYAVrgUCPnJChz5t

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1828	ee68d5b9afa1bb94de51576e7a7810a1e9ea4a830fbf10fd1df8330159a41d2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ee68d5b9afa1bb94de51576e7a7810a1e9ea4a830fbf10fd1df8330159a41d2f.exe
"C:\Users\Admin\AppData\Local\Temp\ee68d5b9afa1bb94de51576e7a7810a1e9ea4a830fbf10fd1df8330159a41d2f.exe"
1⤵
- Loads dropped DLL
PID:1828

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nst9D8E.tmp\inetc.dll

Filesize
31KB

MD5
5da9df435ff20853a2c45026e7681cef

SHA1
39b1d70a7a03e7c791cb21a53d82fd949706a4b4

SHA256
9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

SHA512
4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

Download Submit