bf03b788ad754f29d687c6cc1a116e0c43c48612dff6bb1834059df31478d5e6

Analysis

max time kernel
44s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:45

Target

bf03b788ad754f29d687c6cc1a116e0c43c48612dff6bb1834059df31478d5e6.exe
Size

4.0MB
MD5

a7a4a746b4da3e5ba3ab8be9a50fa537
SHA1

2fa99addd25b99eeb5b4fab87643683eef32bdcd
SHA256

bf03b788ad754f29d687c6cc1a116e0c43c48612dff6bb1834059df31478d5e6
SHA512

6eac2bf5b8a3eec3281dc882524b87f966cbbca9b1fa691b6fe535750ecaaec04149e16bb82a9923dd4114fab0c72850b588b2ed08a8fe3dd9cec99ca4a850ef
SSDEEP

98304:k+A/E/yNor9FSwKDkZHyLEElbmrLYx1VOgNQKfjq3u0xt1kYJ3p:JA8/yNor9FSwDZHmzx1XRq+ut+O3p

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
2016	bf03b788ad754f29d687c6cc1a116e0c43c48612dff6bb1834059df31478d5e6.exe
2016	bf03b788ad754f29d687c6cc1a116e0c43c48612dff6bb1834059df31478d5e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\bf03b788ad754f29d687c6cc1a116e0c43c48612dff6bb1834059df31478d5e6.exe
"C:\Users\Admin\AppData\Local\Temp\bf03b788ad754f29d687c6cc1a116e0c43c48612dff6bb1834059df31478d5e6.exe"
1⤵
- Loads dropped DLL
PID:2016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\InstTemp0\userinstall.dll

Filesize
2KB

MD5
441047684607f1509e487cb74e38443e

SHA1
eefb77c3b4fa02735e1de5fe6ee27a1847e415ad

SHA256
9c1b215ec8cfa5af8bf0f5e97d1e8e471b09003f0b585ad8e55ef23aaa25e2d0

SHA512
06a4f92b56c31b618a0bd13b17383c9952ce86ee4c9fc1c8600ac09c31edb7b54ec8cd43cab71146daa311e8eadd6de22e8fe45e3a3f19e9b50ff78d4b841094

Download Submit
\Users\Admin\AppData\Local\Temp\xns82C.tmp

Filesize
764KB

MD5
cc75fb99e934cde728f760034ba46282

SHA1
81fad642514cc7ec2cc6e37b4261ae84d171fc83

SHA256
fb35563db4e513879246ff6aaac18653758de06468d7afcaf955abef6259f139

SHA512
a246437a6bc74f8f9e0c252069984bda4f0ab0751e2c20b39afb8d79b53f786674f3c531c00598b29d7a6b8f2baed99afb993268c0285a5beed0e5a164902d46

Download Submit
memory/2016-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download