834f924e9cda25a052469f30da9f32f6966baf723afdc3d98ac41e6de9ae2610

Analysis

max time kernel
338s
max time network
356s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 05:43

Target

setup_90000170.exe
Size

1.4MB
MD5

f34e66fb58d8cace441e9a6fdd9998aa
SHA1

4b719111844a8788ede32bfd0a93ee0ce1e7410f
SHA256

53e01b61ccf9868ab79aad471e84226b2090f8cba87fa0ec0fb487755e8c19d4
SHA512

4d4072ce78398252ae03591bf886ae8602c49dfc8dc33b31de279bde402714c2a91d38c2ec984077a9b67e4610ec9dea213dc02d381382721c2ea42ae6dc9ab0
SSDEEP

24576:+CgIYG5yhyeFZGi9LEoXjpANX4JzOi30lZl8nNyUcyqWWaDwKbTI1yQEKo9gt6K:tYWyhyeF0i9LEoXjMI07+cybWeY1yQE6

Score

7^/10

Loads dropped DLL 3 IoCs

Processes:

setup_90000170.exe

pid process

4648 setup_90000170.exe
4648 setup_90000170.exe
4648 setup_90000170.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

setup_90000170.exe

pid process

4648 setup_90000170.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

setup_90000170.exe

pid process

4648 setup_90000170.exe

pid	process
4648	setup_90000170.exe

pid	process
4648	setup_90000170.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsj8063.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj8063.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj8063.tmp\tmpudtmmm.dll

Filesize
604KB

MD5
b0e13c40c3c7e6bf4efdf6cd74c9942d

SHA1
b1074b324c945d60d02550aba59f9ab10650bd5c

SHA256
46164d8a590fbb24e886238dd4ca5892a5b600905bd62694e89ff19f9256aa14

SHA512
1b94b2bc6bd50e8d423e57618f7d735fd370e407a78ca8907ac90128825252cfc807137c3ce7010c8a3c2311a51a134f1ea63703aecbd96d1e4b1880eefa82e0

Download Submit
memory/4648-135-0x0000000003230000-0x0000000003373000-memory.dmp

Filesize
1.3MB

Download