20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018

Analysis

max time kernel
54s
max time network
85s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018.exe
Size

370KB
MD5

e107c08937e219669a5ca37d8d41bb2f
SHA1

452007d4059e037b8de6de2521c86460414c68a5
SHA256

20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018
SHA512

bae344e6258a908401e7f3a108221c0e3e42c81aa631e7555ad5fde068166250b0616aea486fd3c4c503770a4199d0e2b2db0244d21559da20a1655e8a040460
SSDEEP

6144:srAGKkJa/gGUL4hoAip7POkeF+CoR6NsDAazCJ9XWpkCWDt3DG2IZtfOyKJ16p5g:sUkJa5ULuoAipYm0sD2wPIIy

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018.lnk	20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018.exe

Loads dropped DLL 1 IoCs

pid	Process
1236	20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018.exe
"C:\Users\Admin\AppData\Local\Temp\20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018.exe"
1⤵
- Drops startup file
- Loads dropped DLL
PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{b2d4c2e7-4071-eb87-b2d4-4c2e74070b9d}\20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018.exe

Filesize
370KB

MD5
e107c08937e219669a5ca37d8d41bb2f

SHA1
452007d4059e037b8de6de2521c86460414c68a5

SHA256
20ab39e503bfd58316cf7d5423c0e9b60d8805bff258632c03afb657ec8bb018

SHA512
bae344e6258a908401e7f3a108221c0e3e42c81aa631e7555ad5fde068166250b0616aea486fd3c4c503770a4199d0e2b2db0244d21559da20a1655e8a040460

Download Submit
memory/1236-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1236-55-0x0000000000AE0000-0x0000000000B0C000-memory.dmp

Filesize
176KB

Download