62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
Size

859KB
MD5

002f0e7512c8e237a3c68a4d4ac379f3
SHA1

a23a12aa3f15a40783629ba8e0db373ff8029d9a
SHA256

62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6
SHA512

9ef557cd98829e6c5faf0ebec02271dc7a961398a7def08e4971f92f152696f945653e33fad4f1269373fed17125041b8f32897b8d8d5dfa2d484fbe4a80665c
SSDEEP

24576:RfT82tzrvnf6W0zue5nWZ0swePjHnyU/x:JY2tnvnf6Zzue5nWTwU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 368	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	5
PID 880 wrote to memory of 368	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	5
PID 880 wrote to memory of 368	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	5
PID 880 wrote to memory of 368	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	5
PID 880 wrote to memory of 368	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	5
PID 880 wrote to memory of 368	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	5
PID 880 wrote to memory of 368	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	5
PID 880 wrote to memory of 376	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	4
PID 880 wrote to memory of 376	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	4
PID 880 wrote to memory of 376	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	4
PID 880 wrote to memory of 376	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	4
PID 880 wrote to memory of 376	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	4
PID 880 wrote to memory of 376	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	4
PID 880 wrote to memory of 376	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	4
PID 880 wrote to memory of 416	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	3
PID 880 wrote to memory of 416	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	3
PID 880 wrote to memory of 416	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	3
PID 880 wrote to memory of 416	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	3
PID 880 wrote to memory of 416	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	3
PID 880 wrote to memory of 416	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	3
PID 880 wrote to memory of 416	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	3
PID 880 wrote to memory of 460	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	2
PID 880 wrote to memory of 460	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	2
PID 880 wrote to memory of 460	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	2
PID 880 wrote to memory of 460	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	2
PID 880 wrote to memory of 460	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	2
PID 880 wrote to memory of 460	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	2
PID 880 wrote to memory of 460	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	2
PID 880 wrote to memory of 476	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	1
PID 880 wrote to memory of 476	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	1
PID 880 wrote to memory of 476	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	1
PID 880 wrote to memory of 476	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	1
PID 880 wrote to memory of 476	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	1
PID 880 wrote to memory of 476	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	1
PID 880 wrote to memory of 476	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	1
PID 880 wrote to memory of 484	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	8
PID 880 wrote to memory of 484	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	8
PID 880 wrote to memory of 484	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	8
PID 880 wrote to memory of 484	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	8
PID 880 wrote to memory of 484	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	8
PID 880 wrote to memory of 484	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	8
PID 880 wrote to memory of 484	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	8
PID 880 wrote to memory of 600	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	26
PID 880 wrote to memory of 600	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	26
PID 880 wrote to memory of 600	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	26
PID 880 wrote to memory of 600	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	26
PID 880 wrote to memory of 600	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	26
PID 880 wrote to memory of 600	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	26
PID 880 wrote to memory of 600	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	26
PID 880 wrote to memory of 676	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	25
PID 880 wrote to memory of 676	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	25
PID 880 wrote to memory of 676	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	25
PID 880 wrote to memory of 676	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	25
PID 880 wrote to memory of 676	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	25
PID 880 wrote to memory of 676	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	25
PID 880 wrote to memory of 676	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	25
PID 880 wrote to memory of 756	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	24
PID 880 wrote to memory of 756	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	24
PID 880 wrote to memory of 756	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	24
PID 880 wrote to memory of 756	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	24
PID 880 wrote to memory of 756	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	24
PID 880 wrote to memory of 756	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	24
PID 880 wrote to memory of 756	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	24
PID 880 wrote to memory of 816	880	62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe	23

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1644
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1224
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1052
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:452
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:336
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:888
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1136

C:\Users\Admin\AppData\Local\Temp\62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe
"C:\Users\Admin\AppData\Local\Temp\62c1b8b70b81d59e8d409ab96d984f7739ff9e483b7b6e3e2fea541a0fa41eb6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/880-55-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/880-56-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/880-58-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/880-57-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/880-59-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download