10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44

Analysis

max time kernel
148s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44.exe
Size

299KB
MD5

c9065a38f8502c7a89e32cf10a0d3c3d
SHA1

dba229a330315929ea56cea269a2f5bcee569c9d
SHA256

10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44
SHA512

78eed06209b898afd8ab3f4c56adf99dc7834f24a38b72c466ff2a63ec246f9c5432836697a5910bd3c32e230edb569f4cb8e7c1db4bf71e09c775775e7638a3
SSDEEP

6144:dhs7HvmjD8aZumkfUSMz12W7sp0dIIy66IQ07a1cpOGs05b44wNwj:dh6vmjDxZumkfqh0QtOupOh0544wNwj

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44.lnk	10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	2652	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44.exe
"C:\Users\Admin\AppData\Local\Temp\10db2504ae98259b168a4623c1ff96746236e017b7b0a948d5ea15496a837d44.exe"
1⤵
- Drops startup file
- Drops file in Windows directory
PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 432
  2⤵
  - Program crash
  PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2652 -ip 2652
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-132-0x0000000004820000-0x000000000484F000-memory.dmp

Filesize
188KB

Download