edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:45

Target

edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729.exe
Size

2.4MB
MD5

237542e2dfcc28669ff8b0f9ea3de3a5
SHA1

d9fb67bca75532650d29c4077a7361bbcc7ab21b
SHA256

edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729
SHA512

9480c2e6cac8f91d9166454db311f21a7ba2658751780798994790f9b0d897596787c7b911685ea05568847ad1ee6f3165846dd7d1ccb6769ed5e23b1b4d4030
SSDEEP

49152:6Jxmdk+30QbQ1qpsp6UlwMjX2ENTNFlr1BeP9fkdL4tkZhV7:6fmR0T1qSpz6wHNTN1BqFKfZhV7

Score

7^/10

Loads dropped DLL 3 IoCs

pid	Process
1776	edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729.exe
1776	edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729.exe
1776	edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729.exe
"C:\Users\Admin\AppData\Local\Temp\edc45368c0f6ca6befe3768ee3b5dfdab73e2bac7231ea0bc2ba4d32590fb729.exe"
1⤵
- Loads dropped DLL
PID:1776

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst982C.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nst982C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst982C.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/1776-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download