62119eaf0496fca2ca4d8084956b3fcd64e345d262099657e5457b993a226d7e

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 05:00

Target

62119eaf0496fca2ca4d8084956b3fcd64e345d262099657e5457b993a226d7e.exe
Size

2.1MB
MD5

6dff6ed464505bbd40aa9795ad876cbb
SHA1

91ae4b743afe9169b6108cbc51dfbca954128bd8
SHA256

62119eaf0496fca2ca4d8084956b3fcd64e345d262099657e5457b993a226d7e
SHA512

e2e3d212f8718b0773366e40b9c3d83f9a9ac9a9935790d83dfacc4cde36640895e811d5926ae3794c06a469609b33e4eafc8cea7937bcfdad8d7883b04cea83
SSDEEP

49152:a+dFTr54vjJvnzn9IdaCBg3bVWFqC3TxDbqPEVVPF:aGTFQVvn79Id5C3EoIVVd

Score

7^/10

Loads dropped DLL 3 IoCs

Processes:

62119eaf0496fca2ca4d8084956b3fcd64e345d262099657e5457b993a226d7e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\62119eaf0496fca2ca4d8084956b3fcd64e345d262099657e5457b993a226d7e.exe
"C:\Users\Admin\AppData\Local\Temp\62119eaf0496fca2ca4d8084956b3fcd64e345d262099657e5457b993a226d7e.exe"
1⤵
- Loads dropped DLL
PID:900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsj3E0C.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit
\Users\Admin\AppData\Local\Temp\nsj3E0C.tmp\IsVista.dll

Filesize
44KB

MD5
344d13fd0fdd2d97e8d61960f40a8a30

SHA1
3f0f120203005eea3e8ed1652a6ea8a607ea934d

SHA256
17bb3331e2300aa01666fbee98b9552cec5e46212a4c5a340c0370b93df88f83

SHA512
b4e49c58503532e270cc369f1cbd14d85edd46da5ab034dad730bd4297887dd541d445d2fbf205820e6afbbdba7ab6d5b78b694467554320fd6db8e06fe4f719

Download Submit
\Users\Admin\AppData\Local\Temp\nsj3E0C.tmp\stack.dll

Filesize
10KB

MD5
0f61a81a543822de5fcb9a8a43f230dd

SHA1
d01d4a0f542f3c654637fdfe5a574fe1f150ece1

SHA256
46b4a72ae8590b0afb3304cc5c13db0502bc4c4cb02f64f37c79008c17db814f

SHA512
596b7a897ba64c32e26ba6168aa3628aad37b187a9814a286298307d8c42eabf8e8a679dbda558f8b2cdc8676c94ec819256432aa5ad7c05a5387759262a4402

Download Submit
memory/900-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/900-57-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download