af46a59f88e4c8bc0ed87ff0b8fdeaa3c12891144f1be380d9ef686d8a399fd5

Analysis

max time kernel
88s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:39

Target

af46a59f88e4c8bc0ed87ff0b8fdeaa3c12891144f1be380d9ef686d8a399fd5.exe
Size

51KB
MD5

01439b5f0e513058636e7027fd77e0e9
SHA1

9715a850f15daeefd4bb176e8ad794b02def1962
SHA256

af46a59f88e4c8bc0ed87ff0b8fdeaa3c12891144f1be380d9ef686d8a399fd5
SHA512

1241fbe8a693a8ebfefa2ede62f414ddfc05973081b77aceb0471646a4154705d8bd9e58bbbdebf0df7d91d6defca3b0f3c3074d968ea47fffb98f1e544d0f18
SSDEEP

1536:3fYBrbzmFizYwUK1G0DRXJfhxYcf2JSK/g:vY4FizYxCDRXJfhucOn/g

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2320	af46a59f88e4c8bc0ed87ff0b8fdeaa3c12891144f1be380d9ef686d8a399fd5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\af46a59f88e4c8bc0ed87ff0b8fdeaa3c12891144f1be380d9ef686d8a399fd5.exe
"C:\Users\Admin\AppData\Local\Temp\af46a59f88e4c8bc0ed87ff0b8fdeaa3c12891144f1be380d9ef686d8a399fd5.exe"
1⤵
- Loads dropped DLL
PID:2320

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsqAF9F.tmp\inetc.dll

Filesize
20KB

MD5
134b93f8bd1f82cd2f1b06c878580703

SHA1
29cdbce7a2caf1f7e4d2a139c42336d490074665

SHA256
45153adf50541316468e2b189a0f8127be9fb29e2f920e7eeaa6aceb438db8c4

SHA512
f970c38debb6631dab7369e2bc96237f16a8fd328d9d35a2b54cb688e1807f62cc6d63230afe89ce5c3945097ae4466872c72929a9623adde3ee57bddf54b692

Download Submit