ac7477183c81628470f63b140464aa59a8d201ed3720e52c4f47c89e9cb6e436

Analysis

max time kernel
155s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 15:41

Target

ac7477183c81628470f63b140464aa59a8d201ed3720e52c4f47c89e9cb6e436.exe
Size

648KB
MD5

e4fc4913542b89d54c3e70ef824d1d67
SHA1

a851fb5f3d21bdf125861a4809cde3066fec0a2c
SHA256

ac7477183c81628470f63b140464aa59a8d201ed3720e52c4f47c89e9cb6e436
SHA512

c0e68f08b5be0c4540dbf5d95f958c16c017570e15b4255a0bb1d6e13afaf939fa8432a23af6493668f81bdb499c35f0f7ed8950bf7cf929eb5fee3ea811bafc
SSDEEP

12288:tNHCXniUPnq0+pmvvm8/U4vFUDBRTFgPCi5G7Cj+Un0sI2XYM:tEiMq5mHmCU4NUDBRTFgC7C6UtIWZ

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4192	ac7477183c81628470f63b140464aa59a8d201ed3720e52c4f47c89e9cb6e436.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ac7477183c81628470f63b140464aa59a8d201ed3720e52c4f47c89e9cb6e436.exe
"C:\Users\Admin\AppData\Local\Temp\ac7477183c81628470f63b140464aa59a8d201ed3720e52c4f47c89e9cb6e436.exe"
1⤵
- Loads dropped DLL
PID:4192

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsbFF16.tmp\exdll.dll

Filesize
3KB

MD5
8be5d8ad3a47cc9a7d3c0190d948d52f

SHA1
476634acb6c38cf977cb47f8a372a50f74789448

SHA256
160f4cfdcbd86d88d0f27fb638b4c36c4c5317e844e31b2b1505d1ff6ee98afc

SHA512
0997d97029fd59d27ab18cad4855fbdbdab8c5d3b0e95b0842a0b7b0f66af3e5f43ddec3fea5a2885d598eb6af7bdd129875c87e64e050b6802f5cace3ed6aef

Download Submit