760895419389b5f73520e6c435b584d699f0e231a99580610dcb2b99f7118c6c

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 21:06

Target

760895419389b5f73520e6c435b584d699f0e231a99580610dcb2b99f7118c6c.exe
Size

1000KB
MD5

2ad67bba64970d54bc83b5b1cb94983c
SHA1

236ca75b1e44eabae00a9586fbb1714b12299bab
SHA256

760895419389b5f73520e6c435b584d699f0e231a99580610dcb2b99f7118c6c
SHA512

5ce4760b98db3a2f6620631a240e51c9afcd44df0805d5e61fb91169f51b018521de4d3f09c19f318976ed8604793b47938e1bef9766e9a5f9f7b4c17359ef9f
SSDEEP

12288:KJddmOxpYT9HC/ywZYDeopyZvSwok586R8KrP11MCjKH1945EabrwYgFdkaDKRNw:UddmypY1cYbpyZv07Kr91M3V94574kpO

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2000	760895419389b5f73520e6c435b584d699f0e231a99580610dcb2b99f7118c6c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	760895419389b5f73520e6c435b584d699f0e231a99580610dcb2b99f7118c6c.exe
2000	760895419389b5f73520e6c435b584d699f0e231a99580610dcb2b99f7118c6c.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nso2AF9.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit