a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc

Analysis

max time kernel
218s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.exe
Size

351KB
MD5

3e7215edbde10c00823337e6131537ce
SHA1

e362b9d622939fd9b338b5190a8c23b6295faa6d
SHA256

a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc
SHA512

8062c25b3499bd9acaca3dbdb78cbb620b3f480929ff75af1c9a102da7c860ab327cd297f98c45f5ba48e64127e3e327b0dfe4bd89b5f5e27abb5667914f63c0
SSDEEP

6144:BhtgOecuuLhY7W0PAINGNZwpoBptLd+nESSaaFebv5JC6CmF+P2xrNttwSi+SA:BhnTH4WIA2WntCv2Yttxi+SA

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.lnk	a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.exe
"C:\Users\Admin\AppData\Local\Temp\a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{59d7e644-7012-7351-59d7-7e6447019911}\a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc.exe

Filesize
351KB

MD5
3e7215edbde10c00823337e6131537ce

SHA1
e362b9d622939fd9b338b5190a8c23b6295faa6d

SHA256
a00afc72d7727c351b2850a6d81aba1adcc4a95648976e750106d96d9bb60dfc

SHA512
8062c25b3499bd9acaca3dbdb78cbb620b3f480929ff75af1c9a102da7c860ab327cd297f98c45f5ba48e64127e3e327b0dfe4bd89b5f5e27abb5667914f63c0

Download Submit
memory/1712-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1712-55-0x0000000000C00000-0x0000000000C2F000-memory.dmp

Filesize
188KB

Download