4d70aec380fc44dde0688051e79573af8c3a4e1d1445ab5773059e6a93c66b82 | Triage

Analysis

max time kernel
61s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 21:26

Sharing

Report Analysis Logs

General

Target

PremierePortable.exe
Size

267KB
MD5

3384d9ed1bdcba2a57d1a1801b461272
SHA1

322f7ba9ccbc16c4e0eb4ff5c1114a61dc0b03c2
SHA256

4d70aec380fc44dde0688051e79573af8c3a4e1d1445ab5773059e6a93c66b82
SHA512

14d84a86e3c23afffc3a3a1bd3c34200d63077ad419a0da3b9066c1b4ccb3797eef3175bd46c865e0f9f502c14307451218ceee028b3ea5eed6e00b7e4075086
SSDEEP

6144:DEUXoWU0JYRUjH3Z2cSbsfOyDApFetnWkL:DElWU8H3Z2cSbRCAX4nzL

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4648	PremierePortable.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\PremierePortable.exe
"C:\Users\Admin\AppData\Local\Temp\PremierePortable.exe"
1⤵
- Loads dropped DLL
PID:4648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc6930.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit