dca4f3b3059161f2d1742d6ab36aae40048ebc03f2685b2c1926f41a5ae693a2

Analysis

max time kernel
156s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 07:06

Target

dca4f3b3059161f2d1742d6ab36aae40048ebc03f2685b2c1926f41a5ae693a2.exe
Size

749KB
MD5

3a603cf0ebf86f29614aca58572cdff3
SHA1

a1425fb187eb3da922d6f6503762d90763e7bdef
SHA256

dca4f3b3059161f2d1742d6ab36aae40048ebc03f2685b2c1926f41a5ae693a2
SHA512

78133586bf8a575ea7f7c7208ec5189a64d05b503fe87929ad9c3ebd24ec40d2b7573d071a2ca47b63f952dd6babc8cf2b015fd2d4ce53e77b75bf65776077ef
SSDEEP

12288:i+W9LdxKx2EOIuZb5yN4GBpPCXZvwcfKKrLxgQYBE3hguh+DMm66Vcs4:i39LOnAZ1yN4GBpqPfKWg7BE3hge+DMV

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1800	dca4f3b3059161f2d1742d6ab36aae40048ebc03f2685b2c1926f41a5ae693a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\dca4f3b3059161f2d1742d6ab36aae40048ebc03f2685b2c1926f41a5ae693a2.exe
"C:\Users\Admin\AppData\Local\Temp\dca4f3b3059161f2d1742d6ab36aae40048ebc03f2685b2c1926f41a5ae693a2.exe"
1⤵
- Loads dropped DLL
PID:1800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsoDD37.tmp\InstallOptions.dll

Filesize
14KB

MD5
fa5beae80dba254fb6c21b58265f5310

SHA1
f2f776611dbbb157b151aa744a7e0be1d4b8c079

SHA256
34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269

SHA512
7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538

Download Submit