Analysis
-
max time kernel
41s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 00:31
Static task
static1
Behavioral task
behavioral1
Sample
4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe
Resource
win10v2004-20220812-en
General
-
Target
4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe
-
Size
20KB
-
MD5
6e43b097540509dd0628b3fffaa65ad0
-
SHA1
b5ae8cbcb11a0c3750fc735ec0fdfb724d4d33d8
-
SHA256
4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05
-
SHA512
619789287720f1f6ba0f0175d5615235b69a4153166a33ab7446974a8566c3744b633648ed4e915c6459da569d2302a31341ab5f2bb2d49cb11e5b535dbe545a
-
SSDEEP
384:V+d5di3+PfZsDiM3PfsBhnRGjLbjnsJzTwJcecqybQ1:QfdPf41ETHw2dqybi
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2032 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2036 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2036 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1676 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2032 1676 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe 28 PID 1676 wrote to memory of 2032 1676 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe 28 PID 1676 wrote to memory of 2032 1676 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe 28 PID 1676 wrote to memory of 2032 1676 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe 28 PID 2032 wrote to memory of 2036 2032 cmd.exe 30 PID 2032 wrote to memory of 2036 2032 cmd.exe 30 PID 2032 wrote to memory of 2036 2032 cmd.exe 30 PID 2032 wrote to memory of 2036 2032 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe"C:\Users\Admin\AppData\Local\Temp\4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 4a36cb3d686de3ed35de293d649d637b81bb585faf282c08107aba100c6acc05.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-