1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2023 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
Size

334KB
MD5

52a33249329dd340956315ef94750c8f
SHA1

6cfe8024a16d20549d5801f46697e9ab5e176d31
SHA256

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd
SHA512

45a0ea78d5cb5c0fb3dc5fc20a197dfef25b2213b57759ccc24c1c555e02e2d750023a4dfb7f9c55cde07b6c8682d9074e82dcb9ca56b159a761aed09e219621
SSDEEP

6144:Aa4TbMMMMMDpMMMM3lMMMM31lrRliq2pd318OtyFPpmNFJ6LSO/jiW6UAPwuPShH:p4XMMMMMdMMMMVMMMMlgqCcyyFhmuPLT

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

pid	process
4612	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
4612	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Drops file in System32 directory 1 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\lutidine.ini	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Drops file in Windows directory 1 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

description	ioc	process
File opened for modification	C:\Windows\Deriet71\Rigsombudenes\Afsprrede.cer	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3304 4612 WerFault.exe 1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

pid	pid_target	process	target process
3304	4612	WerFault.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

C:\Users\Admin\AppData\Local\Temp\1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
"C:\Users\Admin\AppData\Local\Temp\1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1148
2⤵
- Program crash
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4612 -ip 4612
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse92EF.tmp\Math.dll

Filesize
66KB

MD5
c913926b30cf22f7aed8846f419f7858

SHA1
f894d45828ef8f51c096436ff332c2f53e5e3f1d

SHA256
8f1ce72072b1a90ebf7b10ef3f7f314adaf9033691be558fcd064be60065dca7

SHA512
dee20eae6918f556e1f3b52ab69d616e2479b2fe16181d18b21655bc79e3569b07e82191abc45978d02718955792ab06fad453afd18838d729a8a39434116232

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse92EF.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit