d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f

Analysis

max time kernel
189s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 08:03

Target

d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe
Size

3.9MB
MD5

da95d9a64111127ca1be708bad8f2ccc
SHA1

6327f05f458cde56536f2ba815749624c62be290
SHA256

d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f
SHA512

a51b65fa8f16a24f473f4e1b23fcc6c0abc16a268d4d2a367c91797babc9b54e6feadc121165ab66bf443bce4f9498fc7acf10a002cf9fa1e797285da88fd176
SSDEEP

98304:RDGnkRWN+Ci067DeL2iUZz9ZdvyjfXMNgvHNIekdwLBWdwLG:gN+Cw62Nrv0fXMNetIPwL8wLG

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe

pid process

5044 d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4312 5044 WerFault.exe d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe

pid	pid_target	process	target process
4312	5044	WerFault.exe	d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe

pid	process
5044	d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe
5044	d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe
5044	d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe
5044	d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe

C:\Users\Admin\AppData\Local\Temp\d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe
"C:\Users\Admin\AppData\Local\Temp\d4154d35fb6492ab1eebb1b2f79a991b05eb2bc3ac79789963e245156ae93b9f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1316
  2⤵
  - Program crash
  PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5044 -ip 5044
1⤵
PID:2880

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\112844516760\LZMA.dll

Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit