baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 08:29

Target

baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe
Size

3.6MB
MD5

80d083fd45fa051483db09543d20b083
SHA1

dd698804e72b9bcf677acd6b92799adca48d6b44
SHA256

baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54
SHA512

0c641c4ee39d12f70e46daa6aaf12f31b10f3ffa4383c58788a3376e720ac38f2e7e47d1bb74891f1e67c486010bc552b2ea0f1ae4227f52acb87fb0f4eea1be
SSDEEP

98304:RDGnkRWN+Ci067DeL2iUZz9ZdvyjfXMNgvHNIekdwLB/:gN+Cw62Nrv0fXMNetIPwL1

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe

pid process

752 baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

824 752 WerFault.exe baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe

pid	pid_target	process	target process
824	752	WerFault.exe	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe

pid	process
752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe
752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe
752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe
752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe

description	pid	process	target process
PID 752 wrote to memory of 824	752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe	WerFault.exe
PID 752 wrote to memory of 824	752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe	WerFault.exe
PID 752 wrote to memory of 824	752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe	WerFault.exe
PID 752 wrote to memory of 824	752	baaf6d27a288b1516ac30e89bd4265dc7a1bc8ce3af4ddfb257824756e263d54.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 460
2⤵
- Program crash
PID:824

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

\Users\Admin\AppData\Local\Temp\112844451990\LZMA.dll
Filesize
67KB

MD5
d0f2416807f04c559e6394a0a4c7f1d1

SHA1
7df43ffa3716156d282b1e37d12dd1122f0a762c

SHA256
0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

SHA512
8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

Download Submit
memory/752-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/824-56-0x0000000000000000-mapping.dmp

Download