1f72838def192d3ea6979cdade845c9e7ebd0ee04036d91411b276c6632023ba

Analysis

Target

11.exe
Size

658KB
MD5

3218bf7188b16015f272128634e1be02
SHA1

a45544765fedd49950638595df358fc5f45af9f0
SHA256

c5f1daaa4d35896b13cdd1e3024ba61ec6fb0ff557dc8594233a46827054c335
SHA512

46b0e7ce88415eabfbd0cfe31892853868815622a79b01c32ee793e5d1f5cea84f6ee1ad05454116d2227921e2a3ec45c76ba4404372aa6bd9ec68b074624e5d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

11.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3584	11.exe
Token: SeSecurityPrivilege	3584	11.exe
Token: SeTakeOwnershipPrivilege	3584	11.exe
Token: SeLoadDriverPrivilege	3584	11.exe
Token: SeSystemProfilePrivilege	3584	11.exe
Token: SeSystemtimePrivilege	3584	11.exe
Token: SeProfSingleProcessPrivilege	3584	11.exe
Token: SeIncBasePriorityPrivilege	3584	11.exe
Token: SeCreatePagefilePrivilege	3584	11.exe
Token: SeBackupPrivilege	3584	11.exe
Token: SeRestorePrivilege	3584	11.exe
Token: SeShutdownPrivilege	3584	11.exe
Token: SeDebugPrivilege	3584	11.exe
Token: SeSystemEnvironmentPrivilege	3584	11.exe
Token: SeChangeNotifyPrivilege	3584	11.exe
Token: SeRemoteShutdownPrivilege	3584	11.exe
Token: SeUndockPrivilege	3584	11.exe
Token: SeManageVolumePrivilege	3584	11.exe
Token: SeImpersonatePrivilege	3584	11.exe
Token: SeCreateGlobalPrivilege	3584	11.exe
Token: 33	3584	11.exe
Token: 34	3584	11.exe
Token: 35	3584	11.exe
Token: 36	3584	11.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

11.exe

pid process

3584 11.exe

pid	process
3584	11.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact