5316b66b12e71c83d5ae67372d78d90d63527eb705a0784009349a0cbf5066a0

Analysis

max time kernel
125s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 22:21

Target

5316b66b12e71c83d5ae67372d78d90d63527eb705a0784009349a0cbf5066a0.exe
Size

1.3MB
MD5

f992180ebb6625cb593dd02e6233c054
SHA1

3dedd60f0343d5344d40506466118bf3ccb5ce3c
SHA256

5316b66b12e71c83d5ae67372d78d90d63527eb705a0784009349a0cbf5066a0
SHA512

a64c4d9a0b076e02c8e459e1ad4c3d6441dcbf459de3a08d85645f58f4c5f5f2fae7aba204437bcceb6e118645c1fe4262b5a8153cbd0f949452cba57f8399af
SSDEEP

24576:5sVjPb1l3uRn+0tNR/1E2l16N7WgG0R2kyBJ3yOiJJS6SvZLWvo02H5THYgJv:5sRT/7yR/1d6N7XGlkyBJ3yzJStJWMZh

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4568	5316b66b12e71c83d5ae67372d78d90d63527eb705a0784009349a0cbf5066a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5316b66b12e71c83d5ae67372d78d90d63527eb705a0784009349a0cbf5066a0.exe
"C:\Users\Admin\AppData\Local\Temp\5316b66b12e71c83d5ae67372d78d90d63527eb705a0784009349a0cbf5066a0.exe"
1⤵
- Loads dropped DLL
PID:4568

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsmCBF2.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit