a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe
Size

379KB
MD5

a97d8e359f9ea7786c7463f6f8844ab8
SHA1

c4285689599ab51fbf5fae60900a747a59858b0c
SHA256

a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7
SHA512

75d78d2b880668bc86eee7b05bcf06a4d64ecc4932c178cb85953c4ad31164bbdde285394a584cccf698b5ccea6319529bee47c263b968cbcdaf326f18118ac8
SSDEEP

6144:cn4SOqWZH7nGJO6v/I80V5Ih3l6M+yEJx3G2Q/jSekxvnGWm3oDUJz:cn4XqWV7gPIX7Ih3/LErqx3FJz

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.lnk	a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe

Loads dropped DLL 1 IoCs

pid	Process
1672	a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe
"C:\Users\Admin\AppData\Local\Temp\a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{c969470e-fbb9-d6e5-c969-9470efbb1c3b}\a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe

Filesize
379KB

MD5
a97d8e359f9ea7786c7463f6f8844ab8

SHA1
c4285689599ab51fbf5fae60900a747a59858b0c

SHA256
a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7

SHA512
75d78d2b880668bc86eee7b05bcf06a4d64ecc4932c178cb85953c4ad31164bbdde285394a584cccf698b5ccea6319529bee47c263b968cbcdaf326f18118ac8

Download Submit
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1672-55-0x00000000006F0000-0x000000000071F000-memory.dmp

Filesize
188KB

Download