d467dd91ad2228d18505eec4fe57568aa1c2caf9821c042382b1cbc1dce60285

Analysis

max time kernel
267s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:43

Target

d467dd91ad2228d18505eec4fe57568aa1c2caf9821c042382b1cbc1dce60285.exe
Size

1.5MB
MD5

3d28ff6073d763adfdb6e5e76670632d
SHA1

111f03d9edcc32f148166c837250a4d52ac36f31
SHA256

d467dd91ad2228d18505eec4fe57568aa1c2caf9821c042382b1cbc1dce60285
SHA512

30614eb0136447be7909a62aed60efebc6e46be45dbdd8d75342dde48796bfdf021a93dfc8ae17f807e9264bb18982883ca565778fae99a518e695b9fa09a6b3
SSDEEP

24576:VVv8HfFuOAtj+Nwh3dtd2qnY9rY3wIwOoYupSbL3g1YKoAwchvFgxsvJn2FbRpEu:VV0Sh5dtX/wkT3gcAdtQ4J2FbRXCr0RJ

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
520	d467dd91ad2228d18505eec4fe57568aa1c2caf9821c042382b1cbc1dce60285.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
520	d467dd91ad2228d18505eec4fe57568aa1c2caf9821c042382b1cbc1dce60285.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsfBB47.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
memory/520-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download