fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 04:15

Target

fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0.exe
Size

602KB
MD5

730947540714b5cb34e7fd8e5efc43e0
SHA1

9e8366ba716ce1fb55d066f1cbe7130fb7129ba9
SHA256

fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0
SHA512

3d7790db061f900f2ef8146ef52f3ad393407142e2ed3cec08ec9132f0d87b2895bdb0150adaa54c3f32f692bcaf485d512365ac219a2928f17ca79c9ae7c6c3
SSDEEP

12288:vb4AOtEG6fFRyRuW4CL8Bg4WYSdRobnPi3zyHVYZWy4Pq:vbruEGqTSD4CJCSdmbnYOyWy4Pq

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0.exe

pid process

1076 fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1076	fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0.exe

C:\Users\Admin\AppData\Local\Temp\fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0.exe
"C:\Users\Admin\AppData\Local\Temp\fece1f7cb9f25ea9ed17a700a6824df26e5070a193b062b98bf185f2cd1e3ed0.exe"
1⤵
- Loads dropped DLL
PID:1076

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst8F09.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/1076-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1076-56-0x00000000026A0000-0x00000000032EA000-memory.dmp

Filesize
12.3MB

Download