ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a

Analysis

max time kernel
369s
max time network
449s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:10

Target

mxdbl.pc6.0831/冒险伴侣0831/Baidu_Com_90000168.exe
Size

1.4MB
MD5

d49e4198096aa6f7af3787ba230198c2
SHA1

e7a3c4feb071ec294ce14d74f6e0fa603740f1af
SHA256

2343e15558bba1e08369527cebd7082495c4fb5f1f859f1806f4ac0b464cd304
SHA512

a36ba06bdf98783b33d30b3f87854387493de077a679105ebb4af9e29df809e623738fab5014109e44d5965e8c07173e9f57c92fb1e02dc6b57b03095988dfa1
SSDEEP

24576:eCNjeWLiBF5Addz/++bJnksHBmNqvdOg5m8y01HHiaqulkrpsEG3eX:DjNLsFybzhkaBmNWdN5HyLHekeEG3+

Score

7^/10

Loads dropped DLL 3 IoCs

Processes:

Baidu_Com_90000168.exe

pid process

3816 Baidu_Com_90000168.exe
3816 Baidu_Com_90000168.exe
3816 Baidu_Com_90000168.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Baidu_Com_90000168.exe
"C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Baidu_Com_90000168.exe"
1⤵
- Loads dropped DLL
PID:3816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaCC0.tmp\tmpxblgiy.dll

Filesize
620KB

MD5
e0d8d0a69ce5eeb83594d4517afa54f6

SHA1
b34de8329a7c014d3cf3f5fe6d9d8e679d4918fd

SHA256
ba9e1a46344846aa2138c970f6581fd364bc9369fdbb9402199589fe0645abf0

SHA512
ab7c752abb37165edff8e389f8ee0ac48149c9092decf347989df4ab47e5dd5046c131a74b1e35e15c31f6f95cc69ebd05c8d41162788a151f78e2d9025ca4a7

Download Submit
memory/3816-135-0x0000000003200000-0x0000000003343000-memory.dmp

Filesize
1.3MB

Download