2b3de26b642ed376759f95a87e4623868aaf814ed17af4c7ffb422f586c455a8

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
29/12/2022, 19:57

Target

librewolf-108.0.1-1.en-US.win64-setup.exe
Size

123.3MB
MD5

76699b867cf40164d76080e5606ea955
SHA1

f4664a04ca183fbaefab8f678202360424b70fe2
SHA256

2b3de26b642ed376759f95a87e4623868aaf814ed17af4c7ffb422f586c455a8
SHA512

3d417ce792c9d789260a4ddfcf1dbe2cf3f9a5cdce4a5214bfd377ed798d64107d5b2d7fbde0aa17177a11cd26e2b2048251cf58efb62b0644139b349bb4564d
SSDEEP

3145728:e4RO1NnrkOLVuBUrCUcOMEC9/X4wAPZzCk4CbeLRTwLE/q:xRO1JrnYqO+Mj/3A8kfQRTdq

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
5028	librewolf-108.0.1-1.en-US.win64-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\librewolf-108.0.1-1.en-US.win64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\librewolf-108.0.1-1.en-US.win64-setup.exe"
1⤵
- Loads dropped DLL
PID:5028

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nszF9E6.tmp\nsDialogs.dll

Filesize
19KB

MD5
2f2cd6e22e761b0d4e768b23bef637b2

SHA1
415ed80a3d4d2559bedfcb68d4d104b0d282618f

SHA256
55316f619c56fbb91ae0519e242ff4ae018d12ae03cba200d98533117a72ef3c

SHA512
18d7c0db90e551c1688ec2f53158929cfde43f8b8775e422ced39ddabd03dafca3e957305e7a2d3ad8e727591013c13273e1fd81f63a7b22590c4c72b02aceb8

Download Submit