1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e

Analysis

max time kernel
121s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 08:05

Target

1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe
Size

3.7MB
MD5

0fd35f1ce04dec8ae59223855d29fcd8
SHA1

3b1a8e139a363e6cb3fe658de6e9136c749df880
SHA256

1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e
SHA512

d2e63fdd240c3efc5587a68f09ee9ed58f67ea6447402176f18f0c7ec3c49e56a28926ba65eb94aad7f73eacf23c3682bc682aebe1b6d178b389e6666ad54516
SSDEEP

98304:RDGnkRWN+Ci067DeL2iUZz9ZdvyjfXMNgvHNIekdwLBW5:gN+Cw62Nrv0fXMNetIPwLc

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe

pid process

4572 1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

408 4572 WerFault.exe 1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe

pid	pid_target	process	target process
408	4572	WerFault.exe	1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe

pid	process
4572	1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe
4572	1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe
4572	1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe
4572	1022258c4c7c01bcf72502bcf3cf322245af4d47cdce9601db3cba96b3f0089e.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1076
2⤵
- Program crash
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4572 -ip 4572
1⤵
PID:3680

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\112832029486\LZMA.dll
Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit