3937c74d2f9ab249e2d638ad389d7d08438f62a103f69371719ae7dfc590f57e

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 18:50

Target

3937c74d2f9ab249e2d638ad389d7d08438f62a103f69371719ae7dfc590f57e.exe
Size

1.0MB
MD5

07af77c965c6cb9a8bbcc91cb52c68f5
SHA1

fe47523e297847a7c4f4b898fbd3731ed23c7d77
SHA256

3937c74d2f9ab249e2d638ad389d7d08438f62a103f69371719ae7dfc590f57e
SHA512

d29423a07110bb5928bc9214c51f6c55998f2b6195b38850a9afa7a8b77e61a458428771de8ac490e298a24af5046997e86ddd868b44c60e530cc81e7d2f3f68
SSDEEP

24576:8qoRWKiyLzqeRpeEtImMUIxqijOFKLeIkfnTWt2:r4fly1mMjzjOFKYTw2

Score

7^/10

Loads dropped DLL 3 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3937c74d2f9ab249e2d638ad389d7d08438f62a103f69371719ae7dfc590f57e.exe
"C:\Users\Admin\AppData\Local\Temp\3937c74d2f9ab249e2d638ad389d7d08438f62a103f69371719ae7dfc590f57e.exe"
1⤵
- Loads dropped DLL
PID:4720

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsyC51C.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC51C.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC51C.tmp\Registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
memory/4720-135-0x00000000031C1000-0x00000000031C3000-memory.dmp

Filesize
8KB

Download