a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d

Analysis

max time kernel
305s
max time network
326s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:14

Target

a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe
Size

865KB
MD5

2db64f19fb373f920eb10f3f608e3019
SHA1

5cab6be09e0a04719fce6b36db363f394245baea
SHA256

a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d
SHA512

2e2a2697c053a48726e7dfea07e74e27ebfe5c570a27d3e26771a0df4c583aad6573722e43cffc22e9d5f4221729e73077bba7eda06a3077095ae73f164eb0f2
SSDEEP

24576:KueEdBBdRzUDeXOPWdwhr26uZt2Ggu05EBBD:Ku9rFUDIOPWdsr2TZMGwSB5

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1028	a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe
"C:\Users\Admin\AppData\Local\Temp\a12c06ab70ecfecf784fe2efadb4fc953c9142b0793635c43e475845fb7f787d.exe"
1⤵
- Loads dropped DLL
PID:1028

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsbCECD.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit