Overview

overview

10

Static

static

10

c5f1daaa4d...35.exe

windows7_x64

3

c5f1daaa4d...35.exe

windows10-2004_x64

3

Analysis

  • max time kernel
    138s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-06-2022 17:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5f1daaa4d35896b13cdd1e3024ba61ec6fb0ff557dc8594233a46827054c335.exe

  • Size

    658KB

  • MD5

    3218bf7188b16015f272128634e1be02

  • SHA1

    a45544765fedd49950638595df358fc5f45af9f0

  • SHA256

    c5f1daaa4d35896b13cdd1e3024ba61ec6fb0ff557dc8594233a46827054c335

  • SHA512

    46b0e7ce88415eabfbd0cfe31892853868815622a79b01c32ee793e5d1f5cea84f6ee1ad05454116d2227921e2a3ec45c76ba4404372aa6bd9ec68b074624e5d

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5f1daaa4d35896b13cdd1e3024ba61ec6fb0ff557dc8594233a46827054c335.exe
    "C:\Users\Admin\AppData\Local\Temp\c5f1daaa4d35896b13cdd1e3024ba61ec6fb0ff557dc8594233a46827054c335.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/852-54-0x0000000076781000-0x0000000076783000-memory.dmp
    Filesize

    8KB

    Download