ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f

Analysis

max time kernel
13s
max time network
52s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.exe
Size

2.0MB
MD5

4544c48ee683276c9ca6f95da491d6c1
SHA1

c5a3a7b06c6b1e1fc7cb7a51813819243ac79862
SHA256

ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f
SHA512

1d3d0138fea7750ea5a35cfffcba03f3c1ae09f960ed4d1f922f791c5dc1576f60b4e40f07d4f01bba6e022dd2143dd3bbf4250ee4c0978ed6647fc32d376989
SSDEEP

6144:RlmWwSNKVB+3S1Ige2z4fkR13D7+UKMihPpmf/W3kHHLBGi4vFQXi:RlgSNKmi1IBc4fkR1TClpmfe2rx1Xi

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.lnk	ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.exe

Loads dropped DLL 1 IoCs

pid	Process
1452	ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.exe
"C:\Users\Admin\AppData\Local\Temp\ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{b4597ef5-8dde-27f3-b459-97ef58ddfbd6}\ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f.exe

Filesize
2.0MB

MD5
4544c48ee683276c9ca6f95da491d6c1

SHA1
c5a3a7b06c6b1e1fc7cb7a51813819243ac79862

SHA256
ab83f690434b37f87ec616d4a029c5dbc8f51735905af026eeafdfd45ca8be7f

SHA512
1d3d0138fea7750ea5a35cfffcba03f3c1ae09f960ed4d1f922f791c5dc1576f60b4e40f07d4f01bba6e022dd2143dd3bbf4250ee4c0978ed6647fc32d376989

Download Submit
memory/1452-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1452-55-0x0000000001050000-0x000000000107F000-memory.dmp

Filesize
188KB

Download