a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe
Size

379KB
MD5

a97d8e359f9ea7786c7463f6f8844ab8
SHA1

c4285689599ab51fbf5fae60900a747a59858b0c
SHA256

a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7
SHA512

75d78d2b880668bc86eee7b05bcf06a4d64ecc4932c178cb85953c4ad31164bbdde285394a584cccf698b5ccea6319529bee47c263b968cbcdaf326f18118ac8
SSDEEP

6144:cn4SOqWZH7nGJO6v/I80V5Ih3l6M+yEJx3G2Q/jSekxvnGWm3oDUJz:cn4XqWV7gPIX7Ih3/LErqx3FJz

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.lnk	a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe
"C:\Users\Admin\AppData\Local\Temp\a24210a4c661677dbaf7c8eacdfc37408b11425e8b876b2cf240a5de27cf4cb7.exe"
1⤵
- Drops startup file
- Drops file in Windows directory
PID:4824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4824-133-0x0000000003560000-0x000000000358F000-memory.dmp

Filesize
188KB

Download