8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66

Analysis

max time kernel
18s
max time network
20s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 17:02

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe
Size

34KB
MD5

55f6ce436f1bbae9093e8fcae2efc155
SHA1

47001263656fc8c97d137a0339c25b9026671a9c
SHA256

8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66
SHA512

eba7ee0890f71a9e623ab25c8d6173b4abf848d04bdab962c33282bfd29526fda0079ddb67481963e5a1150780e330e0dfb39e783f458cc57b05bf5d44c6585d
SSDEEP

768:v/O832QhUNI3yIFf1MnQnT/8TF7oyepclS:v/O832Q6cpFRnD8TFYclS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	908	shutdown.exe
Token: SeRemoteShutdownPrivilege	908	shutdown.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 820	1380	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe	27
PID 1380 wrote to memory of 820	1380	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe	27
PID 1380 wrote to memory of 820	1380	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe	27
PID 1380 wrote to memory of 820	1380	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe	27
PID 820 wrote to memory of 908	820	cmd.exe	29
PID 820 wrote to memory of 908	820	cmd.exe	29
PID 820 wrote to memory of 908	820	cmd.exe	29
PID 820 wrote to memory of 908	820	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe
"C:\Users\Admin\AppData\Local\Temp\8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Se.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -t 1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:908

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:760

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Se.bat

Filesize
96B

MD5
b67814c71e18a43252cd56a14ecd44d8

SHA1
9f6a4ffe15d54d6c8073257e9d6e4d4e763ea21e

SHA256
31836bce8cc9ab7b6138af0cfdcbc2ee5197ad09eb2793c9fadca19aa8555012

SHA512
f76ec2990dc2b711b7aae301b318c33f05e6df8b2f50e718094299c79f20ee9ba9c2f806f7a24587971a0d6ba084c70e635a100c7cf59a3b05c7e4bef614cf5f

Download Submit
memory/760-58-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download