985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 05:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46.exe
Size

387KB
MD5

c608df1fa9fbf6cd091f85036faa7863
SHA1

e85a064be505677f155aa871d0b5c900903b3f0a
SHA256

985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46
SHA512

9dce0a761391f30fa22216ed3b21ee9d08572e50fef2da11c2cf538b8b98128d453bf860029a1291c6809b1066ab4a43dd37a401adccdde05e76fb4fae69a4b8
SSDEEP

6144:bT4DtWXQzga9TJq05g6HavztTANBGdQ7oZOg73z7DJGZCBkrcFWYEYpZKvShuSId:bTG99tqGabt0NEdQ7oMeGAS/5YpZK/Rb

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4996	985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Plankways.Bib	985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Chromatophoric\Unlikeably\Dosmerens\Countersigning.unc	985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46.exe
File opened for modification	C:\Windows\Bowerlike\unreprovedness\Afkortede\Ledelsere101.ini	985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46.exe
"C:\Users\Admin\AppData\Local\Temp\985a005774a09763f4ea41709268619cf42bb00d024258d1c9ed362474b80c46.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nswBE45.tmp\System.dll

Filesize
12KB

MD5
a1da6788aeaf78ca4ae1dece8019e49d

SHA1
d770155e6e9aa69223be198c44a8da26a1756d89

SHA256
b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81

SHA512
eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18

Download Submit
memory/4996-133-0x00000000029B0000-0x0000000002A8B000-memory.dmp

Filesize
876KB

Download
memory/4996-134-0x00000000029B0000-0x0000000002A8B000-memory.dmp

Filesize
876KB

Download