Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
22-09-2022 09:01
Behavioral task
behavioral1
Sample
c4c4e2f017a587274c41d56a145d04cd.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c4c4e2f017a587274c41d56a145d04cd.exe
Resource
win10v2004-20220812-en
General
-
Target
c4c4e2f017a587274c41d56a145d04cd.exe
-
Size
27KB
-
MD5
c4c4e2f017a587274c41d56a145d04cd
-
SHA1
b0b26f581aa4b6008671292d4a38803ffb0fe47d
-
SHA256
1d911535128c2a1aa5a7f2a8659b54ca88512f866906f89068c8232852d72798
-
SHA512
4533b7898202e076a1f323c6c8b7b8e8f9ce052496c01bb0e4c58e374720128a18a47e1f5f03db0282704c94ee47a8243a7539cf4e5dc15f255e74f3ce23a77e
-
SSDEEP
384:FLam4PanO4Y7pcdYGiTOLsPodxxM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcaX6m1:F63vc7OB2A/vMHTi9bD
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
c4c4e2f017a587274c41d56a145d04cd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk c4c4e2f017a587274c41d56a145d04cd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
c4c4e2f017a587274c41d56a145d04cd.exedescription pid process Token: SeDebugPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: 33 1672 c4c4e2f017a587274c41d56a145d04cd.exe Token: SeIncBasePriorityPrivilege 1672 c4c4e2f017a587274c41d56a145d04cd.exe