2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:45

Target

2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe
Size

154KB
MD5

63f87118614701fb0b24a468cabec725
SHA1

617ef93b047de0c19d0f5959da008eae44e0e54c
SHA256

2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d
SHA512

d74170f844649671b075ed87c854e75014219fc72313b5cccd8c44c1047526ccdfc71037db66ef8d1c8f866d57650b760a1888f7941187deeb703cbcd066977c
SSDEEP

3072:ujnBTi2CRDZYzIq3+Zlr1+ZNEo3HoHQMw32k:Ihi2CEZ3cY5HJ

Score

7^/10

Loads dropped DLL 3 IoCs

Processes:

2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe

pid	process
816	2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe
816	2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe
816	2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe

pid process

816 2a249ba402cbada9a4cc3e1c5ad5aa7fb1e5dbc39b6636f4d42c5d57fee1b02d.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsy1BAD.tmp\FindProcDLL.dll

Filesize
27KB

MD5
6f73b00aef6c49eac62128ef3eca677e

SHA1
1b6aff67d570e5ee61af2376247590eb49b728a1

SHA256
6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

SHA512
678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1BAD.tmp\inetc.dll

Filesize
24KB

MD5
1fc1fbb2c7a14b7901fc9abbd6dbef10

SHA1
4d9ed86f31075a3d3f674ff78f39c190a4098126

SHA256
4f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e

SHA512
76d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1BAD.tmp\nsExec.dll

Filesize
6KB

MD5
1128ee61dffa0a97d30b2f828235b289

SHA1
b552f3d4f13894f2f30fb446893093ca78fe149c

SHA256
1e33decac84bdd2b3a651c969258f8e6c90616e9ec35de6ab4f402709555ce4c

SHA512
d470356be436997fc53c17b8546cc80b187538ad2f258788761b92c28d91ef733fe6d8b3b33c353d84d1e0ae089207efd1ebfde33a6d33d5a341960e7bcfc8f5

Download Submit
memory/816-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download