681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f

Analysis

max time kernel
304s
max time network
418s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:43

Target

681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe
Size

414KB
MD5

f7639a69e0a1ce594494476d9560cd1f
SHA1

55c60665dcdc8e23a571839730331951a6767ad9
SHA256

681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f
SHA512

a91568de6b1a245dd326d8da0e1711907f2bfc1a429681155434846f77f644276b9fe141692b499cc5594dce7bce6841f3ca72d18428359ecdfa6c8731a53eae
SSDEEP

6144:/0ugHhfpkhcUK2Qzp31miaLkJBen+lQFH/ebsuVS5GRStHMZ4zytbLI:/0uUfpA7mOkJBW/F+vSUIH64zk8

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2680	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Wplugin.dll	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe
File opened for modification	C:\Windows\Wplugin.dll	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe
File created	C:\Windows\explorer.exe.local	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe
File created	C:\Windows\ws2help.dll	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe
File opened for modification	C:\Windows\ws2help.dll	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe
2680	681d79d3a0cd0c12120f01eec3732c4c73971eaf50fe0f596c30ac5a0ef0ff4f.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Wplugin.dll

Filesize
108KB

MD5
8847a8302dacc1d6fca61f125c8fe8e0

SHA1
f399142bbf03660bee1df555ebbf3acc8f658cf0

SHA256
9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943

SHA512
2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f

Download Submit