dc2214d50f7f0720c78aeb3b2532e8b3d17f09ea8e78242a2a8a9be87f340889

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 01:26

Target

dc2214d50f7f0720c78aeb3b2532e8b3d17f09ea8e78242a2a8a9be87f340889.exe
Size

1.4MB
MD5

9e84977f70d73e4bbb71ec83984c0169
SHA1

3921da69e94b292b3727fcfc502b796fb16f93e5
SHA256

dc2214d50f7f0720c78aeb3b2532e8b3d17f09ea8e78242a2a8a9be87f340889
SHA512

f384079d77a6f918716ab5f83afa057d93859289eebd8ee7f5f1516af811e90ea635e9b489b76b26ad08b81c73fb47c54e77ddb5b067208eca16f80e5cfca584
SSDEEP

24576:zQNyNyECYvU2IdTuu+TME3OKcRrGexXMM0tdVWK2LkzbAWS0MKUmD/hfq2XVrSHj:cNyN64dIdiuomxnxXMVdqg0D0MofqeVI

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1944	dc2214d50f7f0720c78aeb3b2532e8b3d17f09ea8e78242a2a8a9be87f340889.exe
1944	dc2214d50f7f0720c78aeb3b2532e8b3d17f09ea8e78242a2a8a9be87f340889.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\dc2214d50f7f0720c78aeb3b2532e8b3d17f09ea8e78242a2a8a9be87f340889.exe
"C:\Users\Admin\AppData\Local\Temp\dc2214d50f7f0720c78aeb3b2532e8b3d17f09ea8e78242a2a8a9be87f340889.exe"
1⤵
- Loads dropped DLL
PID:1944

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsiCE.tmp\InstallOptions.dll

Filesize
14KB

MD5
32aa6334fc543e70ef0f792bb9a0c45a

SHA1
54be1f5004f7e5afe7c9ba160495076ea2a4d60c

SHA256
610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2

SHA512
ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae

Download Submit
\Users\Admin\AppData\Local\Temp\nsiCE.tmp\LangDLL.dll

Filesize
5KB

MD5
51e7fd0885b7d7bf6edc030e17145950

SHA1
be7a62d254f897789cde5b9a77a8b3b0add6d141

SHA256
1a56dfe0bdae779b40d11b9caee5c96e81b9d69b0d45be7c7b11717e1db8c5a5

SHA512
a57c57a3d01839df10ab669bead1d757ef85e4a35cac65a3a147c5e1adaccaae52bb355ed8d4d460a6698cbda3ee8fba395875739670c8cf57884f66306d011a

Download Submit
memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download