6f44ec648ae4514c90c6d47f7f938f75d1008b9bf26bb3b8b21465102c444c60

Analysis

max time kernel
186s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 16:58

Target

6f44ec648ae4514c90c6d47f7f938f75d1008b9bf26bb3b8b21465102c444c60.exe
Size

379KB
MD5

074b5b142f2967040cc9951c6cbd81ee
SHA1

0da87fc8d78adefdffa55156be5eee8639105b27
SHA256

6f44ec648ae4514c90c6d47f7f938f75d1008b9bf26bb3b8b21465102c444c60
SHA512

d414bafb3bb91a7f55610c0f7955ca5c697f31d923138b0e1b71a405978c5feac7c30303ed95008dcae035a4d2e9f3e436d5add2f203097bc464368fdfc3754c
SSDEEP

6144:A99uvxZpExStzyxkbaS40/w76dN0QHj2E/VXiucP5gT4wwjhJvmQ8Q6qIwROOG:5JDExStzqkbBnE6dhkRBjN6XwOOG

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f44ec648ae4514c90c6d47f7f938f75d1008b9bf26bb3b8b21465102c444c60.lnk	6f44ec648ae4514c90c6d47f7f938f75d1008b9bf26bb3b8b21465102c444c60.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	6f44ec648ae4514c90c6d47f7f938f75d1008b9bf26bb3b8b21465102c444c60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/5040-132-0x0000000003770000-0x000000000379F000-memory.dmp

Filesize
188KB

Download