516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc

Analysis

max time kernel
77s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 08:10

Target

516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe
Size

969KB
MD5

4560d26e24f771fafa3cd043bb56a91c
SHA1

508665f2d611183db56988ab56b4ac22323a4b3e
SHA256

516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc
SHA512

30bf3dd59c3eb1c04da70562d87adfa1f479af68fc0369d17e1ad8e9f084e6a8a386c79a0ed5e0f8176e7a94769b702ea4ed572186a55126502c32f9fbb6342d
SSDEEP

12288:D69WNwwo7KR+B4o5cFzOy4Ojh+TNvrGOlb0VZj3yKxuMyZFlpRB1odi:D69Zwo256DOjh+TF0VNCyujZFP1v

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3372	HD_516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4304	3372	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe
2972	516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2972	516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3372	2972	516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe	83
PID 2972 wrote to memory of 3372	2972	516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe	83
PID 2972 wrote to memory of 3372	2972	516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3372 -ip 3372
1⤵
PID:4916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\HD_516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe

Filesize
1.1MB

MD5
eeeb2f02119592fc11f07f92707bf37a

SHA1
a1b9b88ad07e24ab93314409ad92ffdabef2aef4

SHA256
04bb87dc434c2bc9c2da7c85f530b1f5b7c8c956872226a7267fead26b1f4284

SHA512
f3444e21d1eb352ae6e085de62ba52218a27b5874394365be58a7a0e7c2af8bed505e50a98565e1069c2857d427f91688b0fe99dcc1c237502ab07d163943be9

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_516a0b4ac03195b37c432c6a9ace809e663896853c7674f1b1f765cb6d615fdc.exe

Filesize
1.1MB

MD5
eeeb2f02119592fc11f07f92707bf37a

SHA1
a1b9b88ad07e24ab93314409ad92ffdabef2aef4

SHA256
04bb87dc434c2bc9c2da7c85f530b1f5b7c8c956872226a7267fead26b1f4284

SHA512
f3444e21d1eb352ae6e085de62ba52218a27b5874394365be58a7a0e7c2af8bed505e50a98565e1069c2857d427f91688b0fe99dcc1c237502ab07d163943be9

Download Submit