dfdedc4060f4944298bcdf25778b7f7eaaef43fdae61238d7debf88825e66294

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2022, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf648d0d6dc000fee07dbd7b6b04d245.exe
Size 767KB
Sample220830-af2lqaaae8
SHA256 dfdedc4060f4944298bcdf25778b7f7eaaef43fdae61238d7debf88825e66294
MD5 cf648d0d6dc000fee07dbd7b6b04d245
SHA1 28fdfad4f62577cfe3ada300e0697742461e6e39
SHA512 04b2836ecad721841ce56d356e1e14201a7a1a6f798a0bd9b51a3f1cdeb89eafe64614f46c2ea71f37e0993526eb3b7894be1b886ec721d45f5e60c44d99dba0
SSDEEP 12288:qo0YV0J8j5czSBqgXqBf3CSrd6JOosHTWLgtQ5kls8cKXtLyTrjAc+SdgkY:R4WBqzf3Nrd6v+CklFcQOTrCSdgkY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2436	cf648d0d6dc000fee07dbd7b6b04d245.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Bayreren\Socionomen\Transtemporal\Dunkled.ini	cf648d0d6dc000fee07dbd7b6b04d245.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	2436	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\cf648d0d6dc000fee07dbd7b6b04d245.exe
"C:\Users\Admin\AppData\Local\Temp\cf648d0d6dc000fee07dbd7b6b04d245.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 1060
  2⤵
  - Program crash
  PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2436 -ip 2436
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjA00E.tmp\System.dll
Size 11KB
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
MD5 SHA1 SHA512 SSDEEP

Submit Download