115c4156a62f7a2502c3257245c76595eac826841e99bdb07a2ca4308fc81ad0

Analysis

max time kernel
142s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 22:22

Target

115c4156a62f7a2502c3257245c76595eac826841e99bdb07a2ca4308fc81ad0.exe
Size

1.2MB
MD5

eaa4388eeaa0d6d514531dcf0ba72c09
SHA1

b563a54455b1260e6227223c33f5c6356a038c59
SHA256

115c4156a62f7a2502c3257245c76595eac826841e99bdb07a2ca4308fc81ad0
SHA512

a711a1a3d3a35efd1ace52d61074bf7a5469dda889bbd8d88227306d31d7f0b5155d7d3086e9947ba1fd8d21c7162493332f1752b0c775a4c2528df3bc49707f
SSDEEP

24576:4CXaJRpaeUP591+WZ/leKH/sufCWCT+mPZdhX6BJfoVCIqm:4I2oz57+ikIEufCtTTJ6BuLH

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3508	115c4156a62f7a2502c3257245c76595eac826841e99bdb07a2ca4308fc81ad0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\115c4156a62f7a2502c3257245c76595eac826841e99bdb07a2ca4308fc81ad0.exe
"C:\Users\Admin\AppData\Local\Temp\115c4156a62f7a2502c3257245c76595eac826841e99bdb07a2ca4308fc81ad0.exe"
1⤵
- Loads dropped DLL
PID:3508

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsh677A.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh677A.tmp\ioSpecial.ini

Filesize
654B

MD5
236944a9d0dbe5c877eb20ecb3fad216

SHA1
b7ee7a59dfd51b192579d6a7b722273ad035c3b3

SHA256
9fabba7d28f08c8bdb29abbd10ba0181fa77949b7c4626ba6e89c95f2d5a661a

SHA512
802b56b472202657474d4f4b70d83a30719f2bce8e5f1092e3a87784460b405a3bee4f2b9aac8152c09de26eaa5b39ba74c7c418e619e34d13185454cc2b3e0e

Download Submit