Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-03-2022 10:35
Static task
static1
Behavioral task
behavioral1
Sample
7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe
Resource
win10v2004-en-20220113
General
-
Target
7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe
-
Size
28KB
-
MD5
eb8385915f68d5fbbf7c0c05e480a999
-
SHA1
a72734fcddbad58308d91274ad444a5b1d970c21
-
SHA256
7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019
-
SHA512
f75fbebb4583e356e5071b187fd956067f029c46ad2c2b8e300d6d5bfacdce0690abf19b29743f8c6d09dd7e389e5d11067c5292b074d5017f7a444f1770d736
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 976 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exepowershell.exedescription pid process Token: SeDebugPrivilege 1184 7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe Token: SeDebugPrivilege 976 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exedescription pid process target process PID 1184 wrote to memory of 976 1184 7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe powershell.exe PID 1184 wrote to memory of 976 1184 7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe powershell.exe PID 1184 wrote to memory of 976 1184 7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe powershell.exe PID 1184 wrote to memory of 976 1184 7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe"C:\Users\Admin\AppData\Local\Temp\7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-61-0x00000000023E0000-0x00000000023E1000-memory.dmpFilesize
4KB
-
memory/976-60-0x00000000706D1000-0x00000000706D2000-memory.dmpFilesize
4KB
-
memory/976-62-0x00000000706D2000-0x00000000706D4000-memory.dmpFilesize
8KB
-
memory/976-63-0x00000000023E1000-0x00000000023E2000-memory.dmpFilesize
4KB
-
memory/976-64-0x00000000023E2000-0x00000000023E4000-memory.dmpFilesize
8KB
-
memory/1184-55-0x0000000000110000-0x0000000000118000-memory.dmpFilesize
32KB
-
memory/1184-56-0x000000007445E000-0x000000007445F000-memory.dmpFilesize
4KB
-
memory/1184-57-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1184-58-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/1184-65-0x0000000004910000-0x0000000004960000-memory.dmpFilesize
320KB