3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583

Analysis

max time kernel
101s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583.exe
Size

146KB
MD5

f33d372c7081a7c9b670a1bba6ac98ba
SHA1

9baa32c125fd3ca3463af395a1aa6642474fa0eb
SHA256

3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583
SHA512

77fc65712bfa05bcc671a5165ab6c9399bf373b5538f61ce44ff0da03d2ae431378a1db2b22273b40bada941eed75c32d6a7c631f1fe4a83bff71e8d8d53649e
SSDEEP

3072:0H21OD+wHZmJOsugdEbFn8RbswfzxAimeXbsKYIr7na+4KGY0Bu7CzN7:qHjwug68RbhrnUKYGa+4KLmN7

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3372	3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583.exe
3372	3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583.exe
3372	3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583.exe
3372	3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	3372	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583.exe
"C:\Users\Admin\AppData\Local\Temp\3689614486ad6401f3ae69d9f963fae3d565d5a90ca8ecbe46cf558df85ce583.exe"
1⤵
- Loads dropped DLL
PID:3372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 812
  2⤵
  - Program crash
  PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3372 -ip 3372
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dosss11.dll

Filesize
72KB

MD5
b2d78c10ef0df9278426c2b6d03a942b

SHA1
d2a8e14dc7400faea1e1db9552cd2f8cc2426de8

SHA256
f8d266227d261ea22c5013b5e3cf15e2253a7a47d14d6365566e5167a5d72664

SHA512
17b6482df7f60a9c2d7f9c9c9d509dfb1543a096b0ea3f35c5ca2eb8f5cd78e5e67ddf6ef4698b3cb1691264e85acf693672fd8d91d8f814409e146923b18b55

Download Submit
C:\Users\Admin\AppData\Local\Temp\dosss11.dll

Filesize
72KB

MD5
b2d78c10ef0df9278426c2b6d03a942b

SHA1
d2a8e14dc7400faea1e1db9552cd2f8cc2426de8

SHA256
f8d266227d261ea22c5013b5e3cf15e2253a7a47d14d6365566e5167a5d72664

SHA512
17b6482df7f60a9c2d7f9c9c9d509dfb1543a096b0ea3f35c5ca2eb8f5cd78e5e67ddf6ef4698b3cb1691264e85acf693672fd8d91d8f814409e146923b18b55

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst4334.tmp\System.dll

Filesize
10KB

MD5
bf01b2d04e8fad306ba2f364cfc4edfa

SHA1
58f42b45ca9fc1818c4498ecd8bac088d20f2b18

SHA256
d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903

SHA512
30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst4334.tmp\System.dll

Filesize
10KB

MD5
bf01b2d04e8fad306ba2f364cfc4edfa

SHA1
58f42b45ca9fc1818c4498ecd8bac088d20f2b18

SHA256
d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903

SHA512
30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

Download Submit
memory/3372-136-0x0000000002290000-0x00000000022A3000-memory.dmp

Filesize
76KB

Download