ead44d68acb1260be971fa1a3072e3c052c1b829f182274891533023e42712b1

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:47

Target

ead44d68acb1260be971fa1a3072e3c052c1b829f182274891533023e42712b1.exe
Size

987KB
MD5

512ff9abb94c144a4a458dad6989b41d
SHA1

83b6a737b79f004586f0db5d733ccc1b8906dd04
SHA256

ead44d68acb1260be971fa1a3072e3c052c1b829f182274891533023e42712b1
SHA512

14e8b937214fb9b2213a40c8de3f74fc745a843278d934e852028c11639d47d364bbb71f9171eedb5f661bab28ff7fad11710bba31fc6f815b14a45bafff5edc
SSDEEP

24576:pVG5gqXm21ZFMQ/gWUwQKzN+8nF1VB99IQ5fx:LG5H3zn/glPKzN+8nFNI2p

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
800	ead44d68acb1260be971fa1a3072e3c052c1b829f182274891533023e42712b1.exe
800	ead44d68acb1260be971fa1a3072e3c052c1b829f182274891533023e42712b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ead44d68acb1260be971fa1a3072e3c052c1b829f182274891533023e42712b1.exe
"C:\Users\Admin\AppData\Local\Temp\ead44d68acb1260be971fa1a3072e3c052c1b829f182274891533023e42712b1.exe"
1⤵
- Loads dropped DLL
PID:800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsiEB2C.tmp\InstallOptions.dll

Filesize
13KB

MD5
d765c492c21689e3d9d61634371fd861

SHA1
ac200933671ae52c9d5544d0e2e8e9144d286c83

SHA256
551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

SHA512
9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

Download Submit
\Users\Admin\AppData\Local\Temp\nsiEB2C.tmp\System.dll

Filesize
10KB

MD5
fe24766ba314f620d57d0cf7339103c0

SHA1
8641545f03f03ff07485d6ec4d7b41cbb898c269

SHA256
802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

SHA512
60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

Download Submit
memory/800-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download