6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c

Analysis

max time kernel
145s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c.exe
Size

298KB
MD5

ecd6f82a5785318b90be2163d2dc5247
SHA1

9ec9ce35a0ecf44459c3772a57022fca80ead0ad
SHA256

6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c
SHA512

f56c6bf8aa1fdbfbc3aa9d7bcab4fcb71650a4d0e1ad40b86fcf218e0a771f78cf8469e4336dfc2f03c0a7ef94b063d3d00f4d718443fe9c2bc4188a5f947ca5
SSDEEP

6144:UkWwuQyJxbuERRMWpqKM6YCZdxRY2bhXj/TEX3qr6oPhs0:XxOjhR2Wpqh6YCD42VXEHu6gs0

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c.lnk	6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c.exe
"C:\Users\Admin\AppData\Local\Temp\6eec5d8bb20e976eb9207b12b3cea40400172209fade45b9fb66fa1ec738350c.exe"
1⤵
- Drops startup file
- Drops file in Windows directory
PID:2700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-132-0x0000000004A60000-0x0000000004A8F000-memory.dmp

Filesize
188KB

Download