7f5b78bf7aafe4c94b321199316682922709544f5b897f13b6bdccb0afe9086d

Analysis

max time kernel
42s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/02/2023, 15:39

Target

torbrowser-install-win64-12.0.2_ALL.exe
Size

90.4MB
MD5

631e8f2b457b98cd9e8f560eda9f38a4
SHA1

f9c6f1b7e174f59eae4fd0ff39e213b0067242f9
SHA256

7f5b78bf7aafe4c94b321199316682922709544f5b897f13b6bdccb0afe9086d
SHA512

dbeff66ccdfc4cdbb0510889444607279b1c01ffecf6caf911a8f92964d695525d447ed8c045e9f1f44d44c66d257dd42db32d7c1a977e6f540e7815bcbbe893
SSDEEP

1572864:ev6lFZx0atrfTeHrVdjwq88UPO6B3QZ5K88V5pCUtLjNNw1gcqxamCoceGQld0:eCnrtriHrrw1RnEsV5IU5Ogc09Cocel8

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1224	torbrowser-install-win64-12.0.2_ALL.exe
1224	torbrowser-install-win64-12.0.2_ALL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\torbrowser-install-win64-12.0.2_ALL.exe
"C:\Users\Admin\AppData\Local\Temp\torbrowser-install-win64-12.0.2_ALL.exe"
1⤵
- Loads dropped DLL
PID:1224

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsy208E.tmp\LangDLL.dll

Filesize
8KB

MD5
a342d5a613dcf7e57e1f1a1bd4dda897

SHA1
5448bacb7ae79fc1a35624efd130be31ad914ed9

SHA256
58d4aec72eed0f5bfc6d0a292903a4019f406c00f5017ec29831ae35b108a72d

SHA512
5c9d3976cda336f59720584b2e5ade882a956485033ad14ce2038b04388f19daf2a379ef537ee327d36ddc24984d6fc3be4d51f75f73fcb62c1f214561c45b2d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy208E.tmp\System.dll

Filesize
25KB

MD5
a6797f5ba3cc8c13da1c4c374bee9788

SHA1
6e085737a7daf91a2536ae38356bb1786e310469

SHA256
0182ffbba0cc909677cdd00654feae5e35ee047e7c7b094f3b5b320cbed21aaa

SHA512
da5f8eb85faafb26674e31bdfa2c5d8f2e83fef5f4bf1a14aede4fe36305cdd39c0394df65967f85d33fba91a9c083f1c12145bc7a1b4310e89adf93e366ac1a

Download Submit
memory/1224-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download