27cc268c8281f00aef11509df04971d1a7c4cbb6ebd1a94ff08a57ab23c36e7c

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2023, 07:15

Target

Wyciag_26_08102045800000190201217926.exe
Size

1.3MB
MD5

5bfbf906d2abf86676e2c6a92850d9b5
SHA1

265edee82abde5ea4aaf7fe6bb175930b7cdab9c
SHA256

27cc268c8281f00aef11509df04971d1a7c4cbb6ebd1a94ff08a57ab23c36e7c
SHA512

f2aa7a99f98c660babb60c441cdaf370fa2448b206387142ba67391073a5b796bee7ab52e57e5eab1a885aef9221c9fc82e6a032384064a819756fefbce87fb3
SSDEEP

24576:Ntjv5Viy8eORBPfCgflzQgqYPGX4XyuoHd1Zow8fv5nwk:/jBVMRxK1dX4AHdPoNnJwk

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4844	Wyciag_26_08102045800000190201217926.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Wyciag_26_08102045800000190201217926.exe
"C:\Users\Admin\AppData\Local\Temp\Wyciag_26_08102045800000190201217926.exe"
1⤵
- Loads dropped DLL
PID:4844

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsj9F24.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/4844-133-0x0000000004610000-0x0000000008E34000-memory.dmp

Filesize
72.1MB

Download
memory/4844-134-0x0000000004610000-0x0000000008E34000-memory.dmp

Filesize
72.1MB

Download