6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864.exe
Size

153KB
MD5

042320d4127a678f7bde03f331134a1d
SHA1

54b44d57b58caa12c4f4c2eeecda3b05cce89b37
SHA256

6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864
SHA512

20e69647e144b13307e154d63aaec5f0ea241c9f1975201f6df5e221b4a54bbb48cbb43ae2fc8bfcf674af1fa20166fe223f9a1b99c9e1358c826570772949dc
SSDEEP

3072:DQIURTXJ+Mdk9SoJBt6p6QMPdfc5r56bM2WCa5/4UkvWJVxh6vps:Ds9dr6t6Ad0N1FCO4UpJcvps

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3744	dd3dx10_37.exe
2580	dd3dx10_37.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	dd3dx10_37.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3744 set thread context of 2580	3744	dd3dx10_37.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2580	dd3dx10_37.exe
2580	dd3dx10_37.exe
2580	dd3dx10_37.exe
2580	dd3dx10_37.exe
2580	dd3dx10_37.exe
2580	dd3dx10_37.exe
2580	dd3dx10_37.exe
2580	dd3dx10_37.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3744	dd3dx10_37.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3744	1104	6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864.exe	80
PID 1104 wrote to memory of 3744	1104	6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864.exe	80
PID 1104 wrote to memory of 3744	1104	6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864.exe	80
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81
PID 3744 wrote to memory of 2580	3744	dd3dx10_37.exe	81

C:\Users\Admin\AppData\Local\Temp\6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864.exe
"C:\Users\Admin\AppData\Local\Temp\6fbdcb19b7fcd27659c96bcd06455bb4ff8456b5698ec63c4bff304a4315f864.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\dd3dx10_37.exe
  C:\Users\Admin\AppData\Local\Temp\dd3dx10_37.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Users\Admin\AppData\Local\Temp\dd3dx10_37.exe
    C:\Users\Admin\AppData\Local\Temp\dd3dx10_37.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dd3dx10_37.exe

Filesize
144KB

MD5
ae5966670be889d0d82409ab615ccc8d

SHA1
1977c7b19833f59cf37bd27947495e59b6327a3d

SHA256
b95f78ff5b4d2423269a8fcfde95880235be6c129118eccee27da5090c9ef5bd

SHA512
1dd8754d51821c1aced432ec26df509be0a6d97bd12bbb2a4dc9559108d66c533af016c1c3f8c778bdd10f1cf5ad1d95646d2c3f7416f28816fcd1f893506463

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd3dx10_37.exe

Filesize
144KB

MD5
ae5966670be889d0d82409ab615ccc8d

SHA1
1977c7b19833f59cf37bd27947495e59b6327a3d

SHA256
b95f78ff5b4d2423269a8fcfde95880235be6c129118eccee27da5090c9ef5bd

SHA512
1dd8754d51821c1aced432ec26df509be0a6d97bd12bbb2a4dc9559108d66c533af016c1c3f8c778bdd10f1cf5ad1d95646d2c3f7416f28816fcd1f893506463

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd3dx10_37.exe

Filesize
144KB

MD5
ae5966670be889d0d82409ab615ccc8d

SHA1
1977c7b19833f59cf37bd27947495e59b6327a3d

SHA256
b95f78ff5b4d2423269a8fcfde95880235be6c129118eccee27da5090c9ef5bd

SHA512
1dd8754d51821c1aced432ec26df509be0a6d97bd12bbb2a4dc9559108d66c533af016c1c3f8c778bdd10f1cf5ad1d95646d2c3f7416f28816fcd1f893506463

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.dat

Filesize
89KB

MD5
a4577d3d2621bcf9e8a5a2c6f72658ce

SHA1
abb52d032cd4a22780889efbcf4446e20b5c6df9

SHA256
357c30921eaa5c664fd5e4ad2214b498ccd6f53955c1af1713268f70f04a6a5b

SHA512
6a56e77d68c638196fbc84b4ea1db9efe9f9d6c8a82507f7f868d4f219b79645e2727bef97f403b4f428689fe1bbc8cf5544e532869a821e47c3819f23c06437

Download Submit
memory/2580-138-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2580-141-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2580-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2580-147-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download