12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486

Analysis

max time kernel
314s
max time network
381s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 06:41

Target

12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486.exe
Size

313KB
MD5

c7d67686d0092949037d6b55a2fa45c6
SHA1

d6549e7e970a7d1765ace6894d07c6f2066adde1
SHA256

12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486
SHA512

0b40c8788cb315644fc810d5812660e19e5bfd099ff85cdc9fef31d59cc68bd1ac911b45d36126ba5236a26c7746f3c4e689857ebd72287946ae2788fc22e8f8
SSDEEP

6144:u+K0kLpfFHCbzRunsTuFr37ZKn0U8kmsSHyuqxMNwnuy3OFUz:Xk9tHiuemrZA01fs0rqYwd3rz

Score

7^/10

Loads dropped DLL 3 IoCs

pid	Process
3968	12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486.exe
3968	12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486.exe
3968	12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486.exe
"C:\Users\Admin\AppData\Local\Temp\12dae2c46ac927fa82edc5e99de1700881471a771ff1198fadf787603fe6a486.exe"
1⤵
- Loads dropped DLL
PID:3968

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsiE3CF.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiE3CF.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiE3CF.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit