bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b

Analysis

max time kernel
209s
max time network
239s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:26

Target

bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe
Size

409KB
MD5

a6ff4fdb6fd9275f37dc4634d6121b6e
SHA1

60679d4821357fc81ef075b28025f1e6057d23bc
SHA256

bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b
SHA512

0efd99363036dfe4d2501fd362fa022748c69908d793de6ab863dcc21880ab285d2077c32880f157defc2ed3820e39aa7a8a40d01e053a58a6db6d75bd210c29
SSDEEP

6144:yGiZEMW+10ANDatDzdkzmvMOV+S9TRr0fi5F7Kbug+al+5gyqav5EpSM8W7h6E:XMW40Xpkm0yTRr15FlHEyHupSM86hX

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4796	bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe
"C:\Users\Admin\AppData\Local\Temp\bfcd541fd3c8367fbc2a82ce2ba7dad1229cfdc5745b29cd19063fd581383c3b.exe"
1⤵
- Loads dropped DLL
PID:4796

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nswC9F8.tmp\InstallOptions.dll

Filesize
14KB

MD5
fa5beae80dba254fb6c21b58265f5310

SHA1
f2f776611dbbb157b151aa744a7e0be1d4b8c079

SHA256
34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269

SHA512
7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538

Download Submit