756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46

Analysis

max time kernel
91s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46.exe
Size

376KB
MD5

924aad88066a17258eac30d1930fb1c0
SHA1

711f4da1638f5b0e0bf97b72591bc8633e3c1e02
SHA256

756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46
SHA512

8c370e6862ded4685161ea17a1c75cfaf9ebf177c4ab7f3cfb664e65f9273f2e13c6fc4d996547ee925c2b5199003ff1aabf4f814f3f42a5dd4a26a44ed0affd
SSDEEP

6144:5lgjxFvIUrrsI7ro4d71A6eXoucbx715Fc/TT7Kl8cCun6On6FW+5IDIJnIO0+x:Ynfro4dWboucbxx4bo72

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46.lnk	756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46.exe
"C:\Users\Admin\AppData\Local\Temp\756f5ae67112b51125ee6bc5143f15219b242181217c41b6bc6bba0e3d2b5f46.exe"
1⤵
- Drops startup file
- Drops file in Windows directory
PID:4348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4348-132-0x00000000016B0000-0x00000000016DF000-memory.dmp

Filesize
188KB

Download