bf8735fd6255a187c9191f8b3a344142eb420fb3a620cc56e4a0e7f19bdba627

Analysis

max time kernel
40s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 02:23

Target

bf8735fd6255a187c9191f8b3a344142eb420fb3a620cc56e4a0e7f19bdba627.exe
Size

650KB
MD5

f9caa84c2489ff2a0476b5a409fc7ebf
SHA1

b51d2922413b1abf7c4e9f10a187b87a0c99874d
SHA256

bf8735fd6255a187c9191f8b3a344142eb420fb3a620cc56e4a0e7f19bdba627
SHA512

4b5200dcc9ad5b361d45066a6f793c5c521521756ee7a20dbdacf26f45cb92b74ede0337d7ae04be271933d39355f497a4e1e33d87d811e1e94c11f3bcedb666
SSDEEP

12288:VeggbhAdz/iAxigA5CZp0DnETlN+HZvJiA9dVlPqnEJBC+lvIp:0ZC/PMx5CZpMETYvJiA9dVnQ+BIp

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1052	bf8735fd6255a187c9191f8b3a344142eb420fb3a620cc56e4a0e7f19bdba627.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\bf8735fd6255a187c9191f8b3a344142eb420fb3a620cc56e4a0e7f19bdba627.exe
"C:\Users\Admin\AppData\Local\Temp\bf8735fd6255a187c9191f8b3a344142eb420fb3a620cc56e4a0e7f19bdba627.exe"
1⤵
- Loads dropped DLL
PID:1052

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nse252F.tmp\System.dll

Filesize
10KB

MD5
0c8ea8e6637bbf8408104e672d78ba45

SHA1
c231c7acaf9abb7da93f28e1b71bed164d57103e

SHA256
509a93177a7ae130bc3b6b5ec3236c7aa0811b8b86f8ab3442c65fdf8ff85b1f

SHA512
ee763a3cdbbba3b28e6a903ac942c7228bd8e54b19de21d6187e481f2916d833d9b9800e5ac2998f4aa26274cdfb20a8bfdd10f00f2a15d37bcc529b617e1f28

Download Submit
memory/1052-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download