cf1f6cad1eee1bee797a0f80fbccbb12059cf2ea228c6b3d5cce8c7f3e1c814a

Analysis

max time kernel
90s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2023, 23:05

Target

librewolf-107.0-1.en-US.win64-setup.exe
Size

122.4MB
MD5

5dc0adc3e8ed206cf8a239825c7ed089
SHA1

5d6ab93da3ac2db4625f1d5a6dc63b6f5c40cc7a
SHA256

cf1f6cad1eee1bee797a0f80fbccbb12059cf2ea228c6b3d5cce8c7f3e1c814a
SHA512

38f991ee220c0b728ced104a65ed61bf28e13baf63303975eead6b8a2d7f5c233abe75dfe57d19569d0df3d2b64f1be5ce2bdc4bd3ba6b31fc0b4324206cdcb3
SSDEEP

3145728:ejRO1NnrkOLVuBUrC6FaWNnAnLeoP1FM68uzuZV55U4qV87/ZL0T09E:8RO1JrnYqOUaWNnAndM68uyT52+779E

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3592	librewolf-107.0-1.en-US.win64-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\librewolf-107.0-1.en-US.win64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\librewolf-107.0-1.en-US.win64-setup.exe"
1⤵
- Loads dropped DLL
PID:3592

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsh259A.tmp\nsDialogs.dll

Filesize
19KB

MD5
2f2cd6e22e761b0d4e768b23bef637b2

SHA1
415ed80a3d4d2559bedfcb68d4d104b0d282618f

SHA256
55316f619c56fbb91ae0519e242ff4ae018d12ae03cba200d98533117a72ef3c

SHA512
18d7c0db90e551c1688ec2f53158929cfde43f8b8775e422ced39ddabd03dafca3e957305e7a2d3ad8e727591013c13273e1fd81f63a7b22590c4c72b02aceb8

Download Submit