f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.exe
Size

298KB
MD5

de0c28978c2cc18593ca75a33aa9a551
SHA1

c52a78f5745e37e7acb830a7acb456f021533344
SHA256

f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4
SHA512

ae9dbb3539fcf0aadc3cde51bca57470984d05251d94ed74e9c68ab6b78eedf508b33217c16b4e8f36ca740d128476f6a8c78ce65b3942fa46eb947451fdcf71
SSDEEP

6144:gxr4rMpTl+fJ980b3zJ7Bb7reGeNoIbseXgR/Rr:gGrgUf780Pll3eN1bsSgR/Rr

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.lnk	f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.exe

Loads dropped DLL 1 IoCs

pid	Process
1376	f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.exe
"C:\Users\Admin\AppData\Local\Temp\f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{177a0955-6fec-a444-177a-a09556fe2555}\f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4.exe

Filesize
298KB

MD5
de0c28978c2cc18593ca75a33aa9a551

SHA1
c52a78f5745e37e7acb830a7acb456f021533344

SHA256
f4977d762aa91ac20f77e0f60fbdccb863f8f0e07cfcaf0e02a58cdd2bb26bb4

SHA512
ae9dbb3539fcf0aadc3cde51bca57470984d05251d94ed74e9c68ab6b78eedf508b33217c16b4e8f36ca740d128476f6a8c78ce65b3942fa46eb947451fdcf71

Download Submit
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1376-55-0x0000000000710000-0x000000000073F000-memory.dmp

Filesize
188KB

Download