cee2c185b204ae8f396bdbb4ba379744d777873c42d277a7e62a3850e8c7f4be

Analysis

max time kernel
137s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2023, 04:17

Target
1f8d81361d1e3aad75cc56e062309c0d.exe
Size 562KB
Sample230314-ewnr1sdc22
SHA256 cee2c185b204ae8f396bdbb4ba379744d777873c42d277a7e62a3850e8c7f4be
MD5 1f8d81361d1e3aad75cc56e062309c0d
SHA1 84bc57b7f111d23416d21ccb2fad349a8632e0e9
SHA512 7e990187ecd59d522467b6b2a92d299fbb388d9307a5d4f1427fca0958e3d7eef7fedc4eef48dc8b1a1b675690c703c030a29ab31be2375b225babe1d2c9154a
SSDEEP 12288:hTMjg4wizxkv8koWrLtttDwXQxWwtPf3oTBPlcrdIJrBgk:hF4wiz2v8NCtttcXQxWYYTBPlbrmk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1492	1f8d81361d1e3aad75cc56e062309c0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1f8d81361d1e3aad75cc56e062309c0d.exe
"C:\Users\Admin\AppData\Local\Temp\1f8d81361d1e3aad75cc56e062309c0d.exe"
1⤵
- Loads dropped DLL
PID:1492

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss69DC.tmp\System.dll
Size 11KB
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

Submit Download