d76bca5747ca162f2c41cee5b963e53f5eec267f3801657dfd923e1b2cb72d75

Analysis

max time kernel
98s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2023, 04:50

Target

d76bca5747ca162f2c41cee5b963e53f5eec267f3801657dfd923e1b2cb72d75.exe
Size

3.8MB
MD5

dd0b3fd5b37dd522bc9ecb3e25a20571
SHA1

eb103ea381024c14ae3d9848ef03edc9d8c38b01
SHA256

d76bca5747ca162f2c41cee5b963e53f5eec267f3801657dfd923e1b2cb72d75
SHA512

a9fab5ba8fb94eb7664f6725e3395b2af2e5c5331119286ee8cf950b162c62481ec6e48f387de6cfb49737d4973f50d57d4c704764a4c7e1c9adcbe13019e22d
SSDEEP

49152:3WXME1wJinhuwvIQgOc7UbFk0E/9RqOAQMklaxfImgsYFVkt9iUf2+P5PDX4FYWD:GX5aJ+hRIQJxk/9cOWkAGGH2S5PDexD

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
984	d76bca5747ca162f2c41cee5b963e53f5eec267f3801657dfd923e1b2cb72d75.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d76bca5747ca162f2c41cee5b963e53f5eec267f3801657dfd923e1b2cb72d75.exe
"C:\Users\Admin\AppData\Local\Temp\d76bca5747ca162f2c41cee5b963e53f5eec267f3801657dfd923e1b2cb72d75.exe"
1⤵
- Loads dropped DLL
PID:984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsb8C38.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb8C38.tmp\ioSpecial.ini

Filesize
713B

MD5
c67708b83b158ff5b6055cf7cdda797e

SHA1
1d94914d41937622a831b3e7ff550cf27e636d5b

SHA256
5bf95c898206272689cc43b76304958af359013c986bf26986756ba7815989ea

SHA512
6549db8d1ae84ef9261b57645b8f98bafc1a0b225b51530f1fbcdbe2cf38226ed00c751848680c848e62f64222817ffff08ae1433f5f22c33e3691cc41b80f5c

Download Submit