c8dcaacf7aec16af9efd4fe47f2187a72cbeba0f6f2ff9bbaafb816932583f91

Analysis

max time kernel
106s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2023, 09:02

Target

C1B60110015001.exe
Size

614KB
MD5

e3ad93e232ce51020c9cf87bb81d5ae9
SHA1

5ed1ac822f4cde87a4dd893fd97b0c0b5cc7cd5b
SHA256

c27fb94fd688a7bf54d0c0a8a61530cd24e51ae23936f9cad0748f0608cdb2c3
SHA512

b21fba1023631c8a7c891d2b48042db8f95bad0b703cebfeba3690303250c7ca2bdbc1039ff2e4f0ace5845dcb5f203ba1c0b801a09dbd3bcd7917eea4218d5e
SSDEEP

12288:gRcTHNWhikXO+WLf8Li6s2pufcwLznSGKOcoHoNpV4sP:HWhik+XjvLzSG2oHoNgsP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3388	C1B60110015001.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\C1B60110015001.exe
"C:\Users\Admin\AppData\Local\Temp\C1B60110015001.exe"
1⤵
- Loads dropped DLL
PID:3388

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsb57EB.tmp\System.dll

Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
memory/3388-133-0x00000000049B0000-0x0000000005A9F000-memory.dmp

Filesize
16.9MB

Download
memory/3388-134-0x00000000049B0000-0x0000000005A9F000-memory.dmp

Filesize
16.9MB

Download