3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.exe
Size

380KB
MD5

4df72f65b3d4d3b222e6d0cf2fba9383
SHA1

93b9c6e509f6a6a4ed8baa6881a91e0b2a007d2d
SHA256

3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624
SHA512

be8ddebb198be3c7568b134bf390b61ccbf9311006e306d304127b7a8f378b7aa9237a6c1f0e68726205e94be1f2815ddf3046a9f9596c3a9822154b2b3377e8
SSDEEP

6144:0qYtwThmCJxilroVItu9k5/QIsQCOma89Anh2Fz+u7DOo+08L:7YtOmCJxOqEhV08L

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.lnk	3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.exe

Loads dropped DLL 1 IoCs

pid	Process
2032	3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.exe
"C:\Users\Admin\AppData\Local\Temp\3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{41f9f31b-d35b-75c7-41f9-9f31bd35cc6f}\3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624.exe

Filesize
380KB

MD5
4df72f65b3d4d3b222e6d0cf2fba9383

SHA1
93b9c6e509f6a6a4ed8baa6881a91e0b2a007d2d

SHA256
3bbeb4835b9aedd7fce8be9c1462190acd4af7e1ff1eb0e886d838acb4d47624

SHA512
be8ddebb198be3c7568b134bf390b61ccbf9311006e306d304127b7a8f378b7aa9237a6c1f0e68726205e94be1f2815ddf3046a9f9596c3a9822154b2b3377e8

Download Submit
memory/2032-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000A90000-0x0000000000ABF000-memory.dmp

Filesize
188KB

Download