aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 16:51

Target

aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe
Size

666KB
MD5

b28fd356c119621b943109be4b213329
SHA1

db69799a22db22c4904747fa1f2e8aeaad0e1e6f
SHA256

aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c
SHA512

3c888eb7ecddd4d3f30f50521ff0c7291e28466fe206abc4bea6f22b0acb7720523d67fafaaa48d953e3ab54b1b875414d065976530c2427e35e6419eae62ac6
SSDEEP

12288:ObzpYNtMWKyJ/hpq4BVO7akKrnoyfHT8p:OpY6Sppq4BgOrnHr8p

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe

pid process

3996 aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4824 3996 WerFault.exe aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe

pid	pid_target	process	target process
4824	3996	WerFault.exe	aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe

pid	process
3996	aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe
3996	aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe
3996	aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe
3996	aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe

C:\Users\Admin\AppData\Local\Temp\aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe
"C:\Users\Admin\AppData\Local\Temp\aecdb2b8cc48e21c38b4fdc5c23eba46f922f7b2ffe8b035671126618d59810c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1040
  2⤵
  - Program crash
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3996 -ip 3996
1⤵
PID:5080

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\1127937563\LZMA.dll

Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit