f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab

Analysis

max time kernel
75s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 21:55

Target

f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe
Size

923KB
MD5

6ceb0248b1588bf521bc5782239192e2
SHA1

6837c04d53775d2d3178a7a827745615653d973c
SHA256

f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab
SHA512

f08a4e66f7783c7dc5b588bf5e995a3090cf75f3dd1274334b46dcc4fe84d9c0be063bf5ad02a6ff4a8f2249e3d87db6d226223042198f3e5df973ddc55fd829
SSDEEP

24576:LmRdSB7yESfH1k+G9aEA94hhzbTc/94TkJcFXpikX:LnB61REAyzbQ/ykiFXpi6

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3628	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\ws2help.dll	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe
File opened for modification	C:\Windows\ws2help.dll	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe
File created	C:\Windows\Wplugin.dll	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe
File opened for modification	C:\Windows\Wplugin.dll	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe
File created	C:\Windows\explorer.exe.local	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe
3628	f89cb183c58e2ed23c6cdcfa4cb46df159a4cdeb1d0b59367dcc5e78963095ab.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Wplugin.dll

Filesize
108KB

MD5
8847a8302dacc1d6fca61f125c8fe8e0

SHA1
f399142bbf03660bee1df555ebbf3acc8f658cf0

SHA256
9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943

SHA512
2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f

Download Submit