d1c0a7043a069e8e3c7e63d87c918d0613be1e4c6c1d0fe4fd05addbfe4367fa

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 15:43

Target

SC_TR11670000.exe
Size

1.3MB
MD5

ee629a7e53e85af4859cd0418846daa2
SHA1

194c54dcfb2408a662f98af6a4c7b8d636fa0fbe
SHA256

d1c0a7043a069e8e3c7e63d87c918d0613be1e4c6c1d0fe4fd05addbfe4367fa
SHA512

c811b53be41efbd3f76e0631491d0bb2a2f960cedc2a76dbd659a6fb404c6b097efac5ebcb91dd9c5ea9dc8e668f98cdf18b63684201988110878ce8dc82ee39
SSDEEP

24576:0s7aBdKQoLBkTHXmEYvre8ef4lfAGI6o8JBTmqibFj0y9whWW3dWTHX5G:z7auQo9G3mOtfGor6ZJBTmTZ/C73dWTY

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2036	SC_TR11670000.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe
"C:\Users\Admin\AppData\Local\Temp\SC_TR11670000.exe"
1⤵
- Loads dropped DLL
PID:2036

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst946.tmp\System.dll

Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
memory/2036-87-0x00000000032B0000-0x00000000064A0000-memory.dmp

Filesize
49.9MB

Download
memory/2036-88-0x00000000032B0000-0x00000000064A0000-memory.dmp

Filesize
49.9MB

Download