7cfd7caed30f34a487fc6f5b69a8a76cb336fb247631a4a8cc81d54400d071f2

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 09:15

Target

7cfd7caed30f34a487fc6f5b69a8a76cb336fb247631a4a8cc81d54400d071f2.exe
Size

114KB
MD5

09e1af50055bb7e9f14184b2541c29a9
SHA1

cb1770ece9fad15667261b3ad8a002f6965780cf
SHA256

7cfd7caed30f34a487fc6f5b69a8a76cb336fb247631a4a8cc81d54400d071f2
SHA512

23ce2f5f84f3ff91d18f00e53bdfc7ec6b7e6ebe3ba88b9e310bd89617ef89fcbceeda476ecbfaf955e2a3c21ec7b28ac8e52329bb9bf53d3533332cc1c466dc
SSDEEP

3072:qgXdZt9P6D3XJXRsLC/fWvcv6qVKyUQsNzQm:qe34lfW+6MUQsNl

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2020	7cfd7caed30f34a487fc6f5b69a8a76cb336fb247631a4a8cc81d54400d071f2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7cfd7caed30f34a487fc6f5b69a8a76cb336fb247631a4a8cc81d54400d071f2.exe
"C:\Users\Admin\AppData\Local\Temp\7cfd7caed30f34a487fc6f5b69a8a76cb336fb247631a4a8cc81d54400d071f2.exe"
1⤵
- Loads dropped DLL
PID:2020

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsj94E2.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download