ad15eb0fca9cdb61c5bac70762d748bba3b5c7228b80949fd11b08a1635ab00b

Analysis

max time kernel
147s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 05:51

Target

ad15eb0fca9cdb61c5bac70762d748bba3b5c7228b80949fd11b08a1635ab00b.exe
Size

41KB
MD5

31f4ba0388289739395fe994c7fb726e
SHA1

85194242eab02c72af1e6c4e30e9883ce68037f7
SHA256

ad15eb0fca9cdb61c5bac70762d748bba3b5c7228b80949fd11b08a1635ab00b
SHA512

5107ad047a08276a1963d9d501d266bbde212f713c041623b54cf1a5e9639ecf93b91457cd9474a87fa5a370c96539a03fab9231d178614e4538b330e79ddd43
SSDEEP

768:t1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJuT7gLG4oxiHtN:7QpQ5EP0ijnRTXJuT7gSnxiH7

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
5024	ad15eb0fca9cdb61c5bac70762d748bba3b5c7228b80949fd11b08a1635ab00b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ad15eb0fca9cdb61c5bac70762d748bba3b5c7228b80949fd11b08a1635ab00b.exe
"C:\Users\Admin\AppData\Local\Temp\ad15eb0fca9cdb61c5bac70762d748bba3b5c7228b80949fd11b08a1635ab00b.exe"
1⤵
- Loads dropped DLL
PID:5024

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsuFA64.tmp\nsWeb.dll

Filesize
8KB

MD5
84bcf3c71e70d5a6e9dc07d70466bdc3

SHA1
31603a1afc2d767a3392d363ff61533beaa25359

SHA256
7d4da7469d00e98f863b78caece3f2b753e26d7ce0ca9916c0802c35d7d22bcf

SHA512
61aefa3c22d2f66053f568a4cc3a5fc1cf9deb514213b550e5182edcecd88fadf0cb78e7a593e6d4b7261ed1238e7693f1d38170c84a68baf4943c3b9584d48e

Download Submit