d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 04:18

Target

d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a.exe
Size

222KB
MD5

12e481efef7e649f18e8a8effcdcef00
SHA1

bf9ad3dc4b4f9447f90727fc9790c7f1f51067f5
SHA256

d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a
SHA512

f574dce31fc1aab7db5897029d946eca1b27168bc982fa0e4cbfab9d640ec29c4f66cb92a9a67b56c08c1351063a94b452cb044fa2159d981cf5dc4528df28d2
SSDEEP

6144:S7MN9mfRl6B10A6paLEYU0ENR1wUp/QPtSWNP:Su9mfyLKp50Ev1rpYPtJR

Score

7^/10

Loads dropped DLL 3 IoCs

pid	Process
4684	d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a.exe
4684	d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a.exe
4684	d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a.exe
"C:\Users\Admin\AppData\Local\Temp\d0c33f2cfc65bdc231d2998fd0193dc7dcf4c7dea0b094a718fc4bb5a1a4921a.exe"
1⤵
- Loads dropped DLL
PID:4684

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsbFDEF.tmp\System.dll

Filesize
10KB

MD5
9b40e5625f6f893a141f4df48ac0838f

SHA1
97dcc3c09f441129d293629a0f0d8d64e56a172d

SHA256
1b2e5f2e29366accc88c4d0a2127f986769d4ccb585621314647374afb518099

SHA512
1d4ba3af8d0a827f4c313fb7c89de1132729f0f6bd8846ea14e5d272dbe5283b12fc3b51b49139fbbad775727e4f1a1a9a5aab40ea401f5fe300235d7cc8b3e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbFDEF.tmp\System.dll

Filesize
10KB

MD5
9b40e5625f6f893a141f4df48ac0838f

SHA1
97dcc3c09f441129d293629a0f0d8d64e56a172d

SHA256
1b2e5f2e29366accc88c4d0a2127f986769d4ccb585621314647374afb518099

SHA512
1d4ba3af8d0a827f4c313fb7c89de1132729f0f6bd8846ea14e5d272dbe5283b12fc3b51b49139fbbad775727e4f1a1a9a5aab40ea401f5fe300235d7cc8b3e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbFDEF.tmp\nsDialogs.dll

Filesize
8KB

MD5
6308421518c3b18018c223ba7a375a07

SHA1
1a8acf808b7172ae861da3d132479f31145958eb

SHA256
b79aa0bbad073cba2bb8fe9555618966c9231e45b8f5ff8f535e8b5498733fb3

SHA512
c08ec072ce156cd68bf7e2abf31f5cfaefdd972cdccd7f3e2c7854ab50f1dce4344b116250c8ef3ed6419ce264b2af0e1b03f9208febcc4b042faa20b95c7967

Download Submit
memory/4684-135-0x0000000002301000-0x0000000002303000-memory.dmp

Filesize
8KB

Download