000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:35

Target

000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f.exe
Size

304KB
MD5

bd66a962796fe7bb84560c7d425baa2c
SHA1

f52c512b9b965a58f4aceb019e50445db7f49593
SHA256

000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f
SHA512

a0f0d87ab1b57aa1fc8580a1d1a56f8befbaf2712ba6587ee12ed5d036cf1deca55d2398db96afbe72aaef5827570024f35df0c24840e3fe28cba2d8cf2185d9
SSDEEP

6144:wUp51NmS9iWPHPruk/NxcQmPW7solD3oTZLAfX7HznT:wUOCaklxcfADYFAfXLf

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f.exe

pid process

1692 000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1692	000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f.exe

C:\Users\Admin\AppData\Local\Temp\000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f.exe
"C:\Users\Admin\AppData\Local\Temp\000d04312854f1f558e8ce70ab0d68162464f220f5a30fc264871a195cf4353f.exe"
1⤵
- Loads dropped DLL
PID:1692

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nso6099.tmp\InstallOptions.dll

Filesize
15KB

MD5
a6b09891f9678718d542a8b99394091c

SHA1
a8d1d2039540866c0f259ba45f3bfac07a1594fe

SHA256
df80337ca9b1e944a417cf169e7696692ec60338de24489e49cf2f58e5b21f65

SHA512
77fdb7a4ff780d11c09315a135a6e4fb85a7cb4bb7c58c8ae6b554976eb23de0c6a64755cd27cd574b834132748813fffd3d8e43aa1f4fdd0234be30416d137d

Download Submit
memory/1692-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download