eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff

Analysis

max time kernel
147s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Size

72KB
MD5

ce897b97d99cdb68c775ab3c45006d5d
SHA1

6f2e8a907ef5e734552b63e49ea0ef200ad566f9
SHA256

eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff
SHA512

4920c28f8eca6657424e5130a9f3d5ca7eeb3bb9f0108fa1443be1347f7ff7f7b2413e6605ea0cc332bdaad097d1544daa21c9aceec6faaca013e4fe78b3ab3f
SSDEEP

1536:Z3/JPL8wVS52OH7rtWO5frVyq1h33/JPL8wVS52OH7rtWO5frVyq1h5RJ:jlSxH795zVyAhJlSxH795zVyAh5RJ

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0"	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.IE	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\ = "????"	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE "	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.IE\ = "IE"	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\NeverShowExt = "1"	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2264	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
2264	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
Token: SeDebugPrivilege	2264	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2264	eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe

C:\Users\Admin\AppData\Local\Temp\eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe
"C:\Users\Admin\AppData\Local\Temp\eb0685debd40d855e9ec4d3ad3fbbfabb7e5ba129a69e57dfa503bdf2e56ebff.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-133-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2264-135-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download