439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.exe
Size

376KB
MD5

159a784efdf89cb874d928064c8fe060
SHA1

17d83d3886e3c8a7aa8398777a95d97f5186cf05
SHA256

439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513
SHA512

cdda09dc2b47916f23f0976e0402660f7c87debca10e0db4551266000bc9c560b27d61d7d6815b4bb0a0387f1f01fd45c969d57f2895aa9a4d06e2aed0e33d1b
SSDEEP

6144:/FrlyWbnjL6ZAM+TSIcZTghPsbGHNhz88tX1sGfwmbZCq37wv9AK+cRkqhR7VDs:Nrg8njL6ZADkg8AX8W/0h

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.lnk	439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.exe

Loads dropped DLL 1 IoCs

pid	Process
1448	439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.exe
"C:\Users\Admin\AppData\Local\Temp\439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{b34ea222-d8ed-1ed2-b34e-ea222d8e888b}\439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513.exe

Filesize
376KB

MD5
159a784efdf89cb874d928064c8fe060

SHA1
17d83d3886e3c8a7aa8398777a95d97f5186cf05

SHA256
439ca06897657363acefd644d5801865ddce944a6e2cb2ae968b943950a41513

SHA512
cdda09dc2b47916f23f0976e0402660f7c87debca10e0db4551266000bc9c560b27d61d7d6815b4bb0a0387f1f01fd45c969d57f2895aa9a4d06e2aed0e33d1b

Download Submit
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1448-55-0x0000000000210000-0x000000000023F000-memory.dmp

Filesize
188KB

Download