af2aa04c23c1596d0ab34e6669e97e0914f1ea9aaf944a8ba434261218394dba

Analysis

max time kernel
7s
max time network
15s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-01-2023 18:54

Target

Photoshoр.exe
Size

151KB
MD5

e5b3e33e4a98ddda998c48f03afff055
SHA1

107b88ccd757ad5943ab1b9abe0ab6e206d5e0c2
SHA256

af2aa04c23c1596d0ab34e6669e97e0914f1ea9aaf944a8ba434261218394dba
SHA512

c763cd0d7a640a457615683bde0f78fa976657dd69b6de04a0384c5cec307c4e108da7746ef3f8dc6b6467fe3143d573ebea3ca4e59649a59b754dab7ec22a2f
SSDEEP

3072:MweqOYEUXPnY0pl+47ThEetddfbzw/6Q/yXAHaR+j:tEUXQ7AThpddfvw/6u4GaR+j

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1904	Photoshoр.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Photoshoр.exe
"C:\Users\Admin\AppData\Local\Temp\Photoshoр.exe"
1⤵
- Loads dropped DLL
PID:1904

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst56AB.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
memory/1904-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download