6111cc3b4b51d0f8bb305675d390cbe1e0fc4468033544221cddaab9579ef18b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 22:36

Target

6111cc3b4b51d0f8bb305675d390cbe1e0fc4468033544221cddaab9579ef18b.exe
Size

671KB
MD5

07313dd133108e3c5073557607b59071
SHA1

d6eca5b85122e42f282240d06229ef8aa6e1c249
SHA256

6111cc3b4b51d0f8bb305675d390cbe1e0fc4468033544221cddaab9579ef18b
SHA512

835a094e3e4c98090179671a4345419c5464d1e05100f1e50e59918a4429f664e59139432b1c36a5e5e7a578a647d73280481585228ed5cede3e208f5817e566
SSDEEP

12288:t+ZosTximSh0SCpPjuTSNzTEStn8iuZZS2TpXdahT0zIySqdJm0Bfc8vy4hL:t+XTQ0SCpiTSNTESJ6ZZL+x02qWR86q

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2820	6111cc3b4b51d0f8bb305675d390cbe1e0fc4468033544221cddaab9579ef18b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6111cc3b4b51d0f8bb305675d390cbe1e0fc4468033544221cddaab9579ef18b.exe
"C:\Users\Admin\AppData\Local\Temp\6111cc3b4b51d0f8bb305675d390cbe1e0fc4468033544221cddaab9579ef18b.exe"
1⤵
- Loads dropped DLL
PID:2820

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nse6D75.tmp\AdvSplash.dll

Filesize
6KB

MD5
13cc92f90a299f5b2b2f795d0d2e47dc

SHA1
aa69ead8520876d232c6ed96021a4825e79f542f

SHA256
eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb

SHA512
ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3

Download Submit