ed3e434362045111e48b9d30c9cb1dd21f58dc625b4cd862cf483ecc5a61df33 | Triage

Analysis

max time kernel
1543s
max time network
1580s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:03

Sharing

Report Analysis Logs

General

Target

DriverPack-17-Online___75dbu7ggnl392xn.exe
Size

8.6MB
MD5

a590a3b8eb80efd0b8ce98bfe1f6f465
SHA1

a1db5703428e8bc6ecf3f0e425db647375561f22
SHA256

ed3e434362045111e48b9d30c9cb1dd21f58dc625b4cd862cf483ecc5a61df33
SHA512

777af0c9f32497165053b886fc1773a9db5cc281971ed1fc9f666bbed839ef510339e13753b6c5626c7504df1381096a3c42c6ae49d6b99f0e9b8fcb51540c7b
SSDEEP

196608:TRAwoqFBMTns8HJAiQqGkr3DRnDSuTJ6ZMW9j:TRAfA0ZJr53ZSuk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

DriverPack-17-Online___75dbu7ggnl392xn.exe

pid process

5112 DriverPack-17-Online___75dbu7ggnl392xn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online___75dbu7ggnl392xn.exe
"C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online___75dbu7ggnl392xn.exe"
1⤵
- Loads dropped DLL
PID:5112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz94A5.tmp\InstallOptions.dll
Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit