06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 07:35

Target

06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe
Size

2.4MB
MD5

478542096771ef9c54d21cd8018c418d
SHA1

39e91498c58cf89cc7b4e173cd15412dbd74a9c2
SHA256

06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700
SHA512

b30c36d953fd2540f12f25f4180ecfd6bb4657aa4dac2f4a974a465bedf7eba4bfd95f7c3961028c8f38f4fddb00c98afe3ce71a30b4bb244093a72dd9068572
SSDEEP

49152:EGM4GOrnHwDQSkRfYNjX5+nCi1a67GV+d4L28hUZzqmZxPHvLm48f:RDGnkRWN+Ci067DeL2iUZz9Zdvyjf

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe

pid process

4772 06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4628 4772 WerFault.exe 06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe

pid	pid_target	process	target process
4628	4772	WerFault.exe	06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe

pid	process
4772	06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe
4772	06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe
4772	06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe
4772	06f191b594dc6bc0a974ad00017d1e9578db673169b10e072662bcb70afab700.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1276
2⤵
- Program crash
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4772 -ip 4772
1⤵
PID:4744

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\11284829664\LZMA.dll
Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit