f0dbf35b026acb481bb42d8fc6155d952c521792ebc1bdd52e3152342a317f92

Analysis

max time kernel
3s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 15:16

Target

PrismLauncher-Windows-MSVC-Setup-6.3.exe
Size

15.5MB
MD5

cdafdb2c5d1671ec3953b32172ccdb80
SHA1

06ca76295dd916a1f12a9f34a088426450a643ce
SHA256

f0dbf35b026acb481bb42d8fc6155d952c521792ebc1bdd52e3152342a317f92
SHA512

4a09c540a3c831453af56613c2a8272a4c15d661f0e3c8343488c2606e7c594783e888ae2d5521a12a0736f6bb922a74751f1f36fd25a24281e59528e10c96fa
SSDEEP

196608:LCiFgS9OWiVxhbStnh3nDohlG3fxkIIdfwbdo0ctmVwKyZCGdYcpH84aPsX0Twfu:LbgYohEhqk3ARw0moC6bNFX/DX+DtGJS

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3744	PrismLauncher-Windows-MSVC-Setup-6.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-6.3.exe
"C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-6.3.exe"
1⤵
- Loads dropped DLL
PID:3744

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsd6BA0.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit