f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Size

189KB
MD5

3028be4bf2ba902d69ee89706237b225
SHA1

959a4f48df0f4a1ea75391b45b152b2fa431e6ae
SHA256

f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0
SHA512

9880c7af4c7aaf544a9a2cebec65aa8e684798fef5a0a74f01c5833dbf93f5f6076b6b5b28b052eb827d8fdf3702bff206d13028f2f3ba534d7a90adee5ecc77
SSDEEP

3072:FDzwcnC37u7rVWikKU7oXlCtZrILQf2nGCKp1VQgJf6FJq1+uLO6jCxRMrh8XpxP:FDzwcnC367OoX4t5IkrQ984uLOfggxDD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe

C:\Users\Admin\AppData\Local\Temp\f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe
"C:\Users\Admin\AppData\Local\Temp\f20e4bf336975a4d067e22c1e7966a16a8e4a4aec2a8c1448563679b2a6d06d0.exe"
1⤵
- Modifies registry class
PID:544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-132-0x0000000001000000-0x000000000106D000-memory.dmp

Filesize
436KB

Download
memory/544-133-0x0000000001000000-0x000000000106D000-memory.dmp

Filesize
436KB

Download