a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b

Analysis

max time kernel
96s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 04:11

Target

a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe
Size

2.5MB
MD5

69abd55d2182099abf45431e2b8e75be
SHA1

e5406dbca2b9f06dcd66e577aa11a2a86009e061
SHA256

a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b
SHA512

92d008d416009fb2d79ad98cf458a5d93ad54b74438adde67f0e32e8a165e25015bec8a91b56788e35a7fa21579e1ac1b2718c3b163608cc780cbe5132e291ab
SSDEEP

49152:unXFW9352hc5vrU8nFWWQ+prv3nTHncbLRlewau1dEHYqnEDyS:CXFW9J2hcxrUS0Z+pz3rcb1DuvaR

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4768	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\ws2help.dll	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe
File opened for modification	C:\Windows\ws2help.dll	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe
File created	C:\Windows\Wplugin.dll	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe
File opened for modification	C:\Windows\Wplugin.dll	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe
File created	C:\Windows\explorer.exe.local	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe
4768	a472109077c96fd23a21b88a89c07c3992caf6dc26715fe9750ffe6f7fa1172b.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Wplugin.dll

Filesize
108KB

MD5
8847a8302dacc1d6fca61f125c8fe8e0

SHA1
f399142bbf03660bee1df555ebbf3acc8f658cf0

SHA256
9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943

SHA512
2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f

Download Submit