38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.exe
Size

295KB
MD5

91e2443a602bf99accecf6e13c04ff50
SHA1

4516b0b4377a2f8e59d49f3accc9eb2bed0d8271
SHA256

38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7
SHA512

f6dddafbe2ad2ae1a71422b1e0471a635a68f36ec4f934b7a74d72a6b6addaed0ea74e33a276e4dada4a1f4e29f7d756ddde667c4f93a1a56101fe24bbf8f112
SSDEEP

6144:VQ6Yd0LZbZhY2U1FCDvzqQy/yvnSV+1hSDh8rkcMgJHK35ITm:VQMZbZhYiDucaV+1h6LcoJ7

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.lnk	38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.exe

Loads dropped DLL 1 IoCs

pid	Process
1488	38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.exe
"C:\Users\Admin\AppData\Local\Temp\38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{8b3eed54-01c1-f1c5-8b3e-eed5401cb550}\38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7.exe

Filesize
295KB

MD5
91e2443a602bf99accecf6e13c04ff50

SHA1
4516b0b4377a2f8e59d49f3accc9eb2bed0d8271

SHA256
38532011b53a8b1f39c77576ba187e53abf72e8b2c3cae0a40db7030d027a2e7

SHA512
f6dddafbe2ad2ae1a71422b1e0471a635a68f36ec4f934b7a74d72a6b6addaed0ea74e33a276e4dada4a1f4e29f7d756ddde667c4f93a1a56101fe24bbf8f112

Download Submit
memory/1488-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1488-55-0x0000000000B90000-0x0000000000BBF000-memory.dmp

Filesize
188KB

Download