60e1a6a93ad368ac92dd0f02f2416e1a0eb5cd3d441a2df8704225bd94fbaad2

Resubmissions

03-10-2022 05:31

221003-f7s2jsbbdr 10

05-09-2022 07:41

220905-jh5wladcak 10

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Request for Quote (Waseda University) 05- 09-2022.exe
Size

558KB
MD5

a1e9139a63b33375b3c2ab70b8fed769
SHA1

da835d5d7ca257b776a8616b365e41084724771c
SHA256

60e1a6a93ad368ac92dd0f02f2416e1a0eb5cd3d441a2df8704225bd94fbaad2
SHA512

43b9e35aa0713ec56876f7bca3e7af9c0a7828b0b6867ea15b609aeed7445501d9546b8ae2908c736b55dbc790dd651e0709de33bd70d4c2b226a69b4afe0a3a
SSDEEP

12288:40SKoJ47FnSzRDnhfbrf+rwr5Do1Q3buie+Dhhr0ZTPHnIDqmhQmuH:lLocFnS1Dnhf2k1JfeeXr0ZHIFK

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

Request for Quote (Waseda University) 05- 09-2022.exe

pid process

2556 Request for Quote (Waseda University) 05- 09-2022.exe
2556 Request for Quote (Waseda University) 05- 09-2022.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2556	Request for Quote (Waseda University) 05- 09-2022.exe
2556	Request for Quote (Waseda University) 05- 09-2022.exe

Drops file in Program Files directory 1 IoCs

Processes:

Request for Quote (Waseda University) 05- 09-2022.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Pterygopharyngeal\Magnoliers.Ral	Request for Quote (Waseda University) 05- 09-2022.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3584 2556 WerFault.exe Request for Quote (Waseda University) 05- 09-2022.exe

pid	pid_target	process	target process
3584	2556	WerFault.exe	Request for Quote (Waseda University) 05- 09-2022.exe

C:\Users\Admin\AppData\Local\Temp\Request for Quote (Waseda University) 05- 09-2022.exe
"C:\Users\Admin\AppData\Local\Temp\Request for Quote (Waseda University) 05- 09-2022.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 132
2⤵
- Program crash
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2556 -ip 2556
1⤵
PID:384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvAF23.tmp\Math.dll
Filesize
169KB

MD5
66f2ce4302893b92295223ed9b5e5e5e

SHA1
e27dc596fe1e2fa5416f3f490c6f2f0b9b5b3077

SHA256
2b05d1dfcf3a57ac6e6ef326611a13f8934b9c56d4e75d65d5e301d2793e09bb

SHA512
38aa695cd86d38af41dfe444faf46707e28141ed1fea636d515fc785a15eadc560a6a30270fde2e5a759dec4d1ff4ee22b5079fd21312eff5974cac76b9720b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvAF23.tmp\System.dll
Filesize
11KB

MD5
2e07bbddc0912b77cac77afe9d9035ee

SHA1
33a4646191dd25c034b5223ebfed761969301710

SHA256
97ace5ce4e05225db3c1345a2d1b5fa7d2281bb51fc5aa2d34c186befa9e000f

SHA512
56c5793b01a1e5c356db005d9833d4c6f703204cff5dbb4613620cd1a90ef5acf91c3e7654295e9f63732a104d83fb471483c188449d75d8c009a81a544fe388

Download Submit