805d9fe1158e0669620a753948b0198d903220e69776b876354e49b4cd78fe31

Analysis

max time kernel
148s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 22:30

Target

SmartHideIPSetup.exe
Size

4.8MB
MD5

c38cbf163425601dece072c2fbd161e3
SHA1

ca2ba8a8bde79bcca63d2b932c801074a2ec6d56
SHA256

062ae3a1c093cab185950af7ffb37c0b6d014bcf147e5ea2184a04144025ad96
SHA512

ae4214fbd50cba8fed84b8569c8785eec3a5f1610d7b95e5e2695977618f01cff0c01d776ac897d8d37d1d5f51324c6c4613820b3a34f1c72907530440f917ac
SSDEEP

98304:jghXsr8Ju0s/4mnCCT4sjFCsDo5NAPPeZfU+ou535d3J7swr:MXsUm/4mnbTJxjuNAPPeZ7ou5zJ7v

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2440	SmartHideIPSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\SmartHideIPSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SmartHideIPSetup.exe"
1⤵
- Loads dropped DLL
PID:2440

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsj1119.tmp\InstallOptions.dll

Filesize
14KB

MD5
ec48a8204e1aed3d9a951cd92158cbe3

SHA1
0db29522e15448553b697b88b31a3d8392efd933

SHA256
3166399ed2ee296749aa412a4ec70807373b6349e9b94a7fcd97c3418f744f0f

SHA512
9b0ab63fbe4bf89ddf93e5fc6922cc95c0586e21dea945ce04065afd7957bd2472e34c909d356123346f62dee4c6d6077a0072810c91b61ad3df4c168cdb79d5

Download Submit