7419ba221d05f87916ed027b0a69b32a21f15ee3dd8f2006bd0ddf7dc64031bf

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:40

Target

Two_Months_Salary_Receipt_09584.exe
Size

1.1MB
MD5

715c1be5e5273f6083be4ef2bd3fe3cc
SHA1

e7ed09e9f3d285e490c5f5a229c04dc5a39cbfb9
SHA256

759a578e4aef3af0d27347bd2eba52b3f39fb0b35114b09e73d0937fe3b91739
SHA512

47bb1605d02538e5caf42e86429e85da9f273f26e20a19acb2700d0072a73dff02a7e8eff28a7e6b0c8ab74bb384f816e31a7407df717168318e182b072d6f87
SSDEEP

24576:qOe0FFQ4kgCXdENSXRTKNukjIHOwwdx+EKRs+h4k:DnkjNEQhegiHPd0EKRs2

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

Processes:

Two_Months_Salary_Receipt_09584.exe

pid process

1380 Two_Months_Salary_Receipt_09584.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1380	Two_Months_Salary_Receipt_09584.exe

Drops file in Program Files directory 2 IoCs

Processes:

Two_Months_Salary_Receipt_09584.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\roadmaster\Preassert\Procorporation.Off	Two_Months_Salary_Receipt_09584.exe
File opened for modification	C:\Program Files (x86)\Ghostwritten\Yderliggeren\Retransmitteres117\Breakpoints.ini	Two_Months_Salary_Receipt_09584.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsd205F.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x0000000003710000-0x0000000003811000-memory.dmp

Filesize
1.0MB

Download
memory/1380-57-0x0000000003710000-0x0000000003811000-memory.dmp

Filesize
1.0MB

Download