Analysis
-
max time kernel
308s -
max time network
360s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
12/11/2021, 06:05
General
-
Target
Priyte's Adventure C++.exe
-
Size
304KB
-
MD5
2a37da5634b1e4b188fc5ef86704e41b
-
SHA1
540ef0e5a197322a29bbf91f41c6abecdd2a4e35
-
SHA256
df9aff8d1a7003c662d20b7ec05d489b7dbd02ebc3034ac61081b5c819791d81
-
SHA512
2fe2ca833e71e7b3ed6ad022d8945db72803483b0358c5f165c775bbe1a7896fe791f296b404b1482ad6bff888ab9ee230bb7c3ef45373687614703f496d2d14
Score
10/10
Malware Config
Signatures
-
UAC bypass 3 TTPs
-
Disables Task Manager via registry modification
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Priyte's Adventure C++.exe"C:\Users\Admin\AppData\Local\Temp\Priyte's Adventure C++.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB