Analysis

  • max time kernel
    153s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 01:16

General

  • Target

    ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe

  • Size

    489KB

  • MD5

    052a2ea735701887331c568bcf2cdf85

  • SHA1

    80cbc46a97b0eb58d0359a3761ed4d0741473a99

  • SHA256

    ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010

  • SHA512

    b8f184f0a80184c8cdcdb240b53e5eec3e7b012990f447d11f0c573d6199aa48a5291e0bdaa9c028b0d0eb986c6358e1f5045256d8df48bfcb6dafac39475690

  • SSDEEP

    12288:BWQfhJ7kNO9EoUOPKD3ypHaWIjsDEDsj:B/J7kY9EoUpDipjED

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe
    "C:\Users\Admin\AppData\Local\Temp\ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe
      C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe 6]3]1]5]5]2]4]3]8]3]8 KU1IPzgvNTUsLxgpUFQ9S0dAOigdJ0hCU1JKUEdGPDopGixDRE5SRUE1LzEwMTMbKkFFQTUtGClNUUo/Uz9RV0Y8Ny83MzQ2HCxLQkpQQlFaUFBIOmBxbGo3LipucHIrPEJLRSpTSksrPU1IK0FIQ04bKkFIRjtIQT46Hyo/LzkqKR0nPi88KCweK0ErOiUrHS4/LzspLhgsPC86LCwbLUxPR0FNPVFeS01HUj47VjUaLE9NSkJRQExcPU9JQDgbLUxPR0FNPVFeSTxLQTpddV0aLERTQF1RT0Q6GClCV0BaQUlBREZGPzofKkNNT1FXP0pJVFJATTsxHSdRQDtLSlRKU1tSSkk1GixVSDgwHCw8UCk3HS5NUExQRkVCV1FCSz5KS0FGRT4/P1JRRzgeK0ZLXEpPS1NESEM5cWpyXRosUUBPU05LQUs/WVJSQE1dQD5RUDUsHS5DREJBVTUuGClGUlo/V0o+RUY7WUJNPk1XTFE9QTVgXmtuYB4rQUdURkZMQD9aR0w6Ki0wKC4wKyk3LyspLyoaLE88TT9IST1JV0NLUk88Skg6bG9tXx0uT0RLQTopMS0qMDYvLC4tHSdBR1FLS0o8QltRQUo9Ny4xKiw1Ky8oLi0kMjkvLDgwLiJNRQ==
      2⤵
      • Executes dropped EXE
      PID:1576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 228
        3⤵
        • Program crash
        PID:4580
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1576 -ip 1576
    1⤵
      PID:4508

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe

      Filesize

      674KB

      MD5

      93c3c1d0d5299bb9cefe9e9181a17070

      SHA1

      77a89de10714fd3862276d65ca4cb440628d81a4

      SHA256

      fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7

      SHA512

      9e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3

    • C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe

      Filesize

      674KB

      MD5

      93c3c1d0d5299bb9cefe9e9181a17070

      SHA1

      77a89de10714fd3862276d65ca4cb440628d81a4

      SHA256

      fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7

      SHA512

      9e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3