3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52

Analysis

max time kernel
182s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52.exe
Size

297KB
MD5

59d3c4f0b5ead95bd43b97c20216154b
SHA1

56efab443587aea66b0bd7095d2ab6e193f3b991
SHA256

3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52
SHA512

84f200e1123cb09593d5c6a22ee13ed9bc861a8f0bdbd090dde816887f08f28471d08a86e4ffc7d596ec22c729e5ab1132d6a26a52606200145fe4a3ff9d074c
SSDEEP

6144:NYaITFHXXMHh3j+OM67Et6z55W08MGmL8eJ:wBHUh3qy4IzSJmL8eJ

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52.lnk	3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52.exe
"C:\Users\Admin\AppData\Local\Temp\3617fd4644d1aee61866e5336aea46c51cdb4e87648b674d1a527d9be38bef52.exe"
1⤵
- Drops startup file
- Drops file in Windows directory
PID:4576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4576-132-0x0000000001840000-0x000000000186F000-memory.dmp

Filesize
188KB

Download