f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45

Analysis

max time kernel
39s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.exe
Size

351KB
MD5

a5c223d056dbf80655daa71db4ec3718
SHA1

7cc2aa8a99e694c09eefa9878d2c802a556ba4ee
SHA256

f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45
SHA512

75abf60c690e0e7cdb47b471395c558605d2616e8aea458f7252ae4876811ae64af6dd98e6e0341f17f4ffb27a6f0dcc073f3e5f71748a2a721a4525850e4b57
SSDEEP

6144:ghtgOecuuLhY7W0PAINGNZspoBpt7d+nESSaaFebv5JC6CmF+P2xrBh59o:ghnTH4WIA2Wftyv2Eh59o

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.lnk	f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.exe
"C:\Users\Admin\AppData\Local\Temp\f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\{1e3741ac-10f7-6185-1e37-741ac10f06b0}\f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45.exe

Filesize
351KB

MD5
a5c223d056dbf80655daa71db4ec3718

SHA1
7cc2aa8a99e694c09eefa9878d2c802a556ba4ee

SHA256
f809df0977f1862a1972b5e2804946b9feddadfeafa2610556190ce5c6c5ae45

SHA512
75abf60c690e0e7cdb47b471395c558605d2616e8aea458f7252ae4876811ae64af6dd98e6e0341f17f4ffb27a6f0dcc073f3e5f71748a2a721a4525850e4b57

Download Submit
memory/1700-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1700-55-0x00000000007D0000-0x00000000007FF000-memory.dmp

Filesize
188KB

Download