d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3

Analysis

max time kernel
185s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:48

Target

d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe
Size

583KB
MD5

512285753a25de92cdc3d1968d362cb2
SHA1

718bfd424394c2e4b466e1ae1af6766b308a001b
SHA256

d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3
SHA512

dc9f5367062f68513eebdcd6db425b9bb474ec567bde83269c9d5a5c700f03f8793b38de33a6b2aeadcea7a239928722d6fe543eb544f204920b04e06314d211
SSDEEP

12288:fGsb73aQW04PueNw5ALbtAOJIecgv0DHEnuK:fGsfao4mxmbtAOHcgvokn5

Score

7^/10

Loads dropped DLL 2 IoCs

Processes:

d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe

pid	process
1240	d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe
1240	d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe
"C:\Users\Admin\AppData\Local\Temp\d5d3bac3339cc973663b2d502baacc20a83f9f2212c62b5b0fbb0d08af4878a3.exe"
1⤵
- Loads dropped DLL
PID:1240

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsa614B.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa614B.tmp\StdUtils.dll

Filesize
18KB

MD5
e03876429de52398e49cf9b308ec97e2

SHA1
c540ca346d63666d40f7d64bec1fdc742ec9b7ae

SHA256
515f58aaad94e1a3c00577e258f9592f5e6eea32e0343392f4611852acf0f906

SHA512
c25ac014c77573af44d44f28ad547bd08f0c6f5b342d5d6269fcbd2dc92f8c2b859ea4091bec9c4e4ad8482b8951b03b526d4bfaddf8f802487d30348aaf627c

Download Submit