716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0

Analysis

max time kernel
150s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0.exe
Size

380KB
MD5

090c56bd6c3dfef08f642ce2d19fec02
SHA1

e92ae85839627629a79f7f5ee16c14476afa4acd
SHA256

716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0
SHA512

f4d67269e758698fdddd1b574f77ad59c00d1025d2f28d74bef6dd7cd0b8eb8d6b5d4a0c298240af832096c3611dcd0051324d23742191a567f1a6dc4e95eb55
SSDEEP

6144:+lVXt5FCRePSiS3Ev+RcyvZKgCXClwhz/drRytsEje7fBTfzQRfJIc22Kmt:QmePvxxyvUgPSZ682Kmt

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0.lnk	716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task.job	716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0.exe
"C:\Users\Admin\AppData\Local\Temp\716e893dd7a1ca428a0d3d54da42f94797636da00d86af2d859c1452b08ac4b0.exe"
1⤵
- Drops startup file
- Drops file in Windows directory
PID:4556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4556-132-0x00000000034B0000-0x00000000034DF000-memory.dmp

Filesize
188KB

Download