cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada

Analysis

max time kernel
129s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:24

Target

cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada.exe
Size

1.8MB
MD5

f19e53b386c8ae40ce9d88be5e68bc8f
SHA1

030aba40618337bfe1077e1ef3a74e23db351944
SHA256

cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada
SHA512

ee09779b8d6874a3e299d29ab5cf08df1d09549eedfb6276d5c0d616c7b4795ebfce60714ae6cff548db2446447f8432249373d0d4a8bdadb3d382b301b34aaa
SSDEEP

49152:7THgdWHqF8ufJtE0+eU5UyRzwj81NTuNhiTr1diZC7B:XA0KyuBO0+piyaj85iE

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada.exe

pid process

2028 cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada.exe

pid process

2028 cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada.exe

pid	process
2028	cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada.exe

pid	process
2028	cdeb7449c71527541dca2295df40e9c61204644a42ae6a08f4e006e6f617fada.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst9F7D.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
memory/2028-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download