1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823.exe
Size

299KB
MD5

d0d956e907ca2b0bb19b2b9088a3b550
SHA1

1295d7ffd884c9b55ec1b4350913c711528fe643
SHA256

1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823
SHA512

b71a36b8e0ccf9ce5ee3ccccff9af158957d60675510f12b7ff64f059f4681426d9fad422da059a5cd5ed86264f1523215890b11dcd8825b5c0c7e61751441a9
SSDEEP

6144:bKWBD4M5U4IpogXl4JXO5MiOEw5dKG1R1:hkYU4IyEs+57mr1R1

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823.lnk	1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	4512	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823.exe
"C:\Users\Admin\AppData\Local\Temp\1ce6f566da82a10edcca3b8297e15e5648f3d37f1c30c8054fc627f04145e823.exe"
1⤵
- Drops startup file
- Drops file in Windows directory
PID:4512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 436
  2⤵
  - Program crash
  PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4512 -ip 4512
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4512-132-0x00000000048F0000-0x000000000491F000-memory.dmp

Filesize
188KB

Download