58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee

Analysis

max time kernel
84s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Size

658KB
MD5

f6befa7964ce7798430ce322ce198a70
SHA1

348ab72bb2e1573a3acb710b422e182a32a283f4
SHA256

58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee
SHA512

45fc31c67f0cab72c5fce17b1248d913bbf60de904fa077ff8a6921f1bfcacb1ca572a467f03ad695a5026d60c1a6d36522265b49fa54956de55fd455c73b36a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeSecurityPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeTakeOwnershipPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeLoadDriverPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeSystemProfilePrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeSystemtimePrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeProfSingleProcessPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeIncBasePriorityPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeCreatePagefilePrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeBackupPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeRestorePrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeShutdownPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeDebugPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeSystemEnvironmentPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeChangeNotifyPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeRemoteShutdownPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeUndockPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeManageVolumePrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeImpersonatePrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: SeCreateGlobalPrivilege	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: 33	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: 34	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: 35	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
Token: 36	2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe

pid process

2224 58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe

pid	process
2224	58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe

C:\Users\Admin\AppData\Local\Temp\58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe
"C:\Users\Admin\AppData\Local\Temp\58edea9b65d4948a1d597dda5ce2e038de2807a7632e82a46554f01638a2f3ee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads