d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a

Analysis

max time kernel
152s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe
Size

557KB
MD5

52876419e4e56935f6f0cd29156a6030
SHA1

2ee7e5d9fda588190865beaf5a186b8518091cdc
SHA256

d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a
SHA512

2b97bec981fa72868aee9d1ed0f6f764e35349232371496ce3956b5dbde608977407791ee77a2b88c5ef641f1649046b8b7442167b78c19fdd466603c3181b6d
SSDEEP

6144:uN73TeVbl0ZnF0y6oSOtrHX6H5wITUXj/MBZEcmUbPl6d1i2QqQwv4TYn+:mSP0ZnFhtSO05ZQj/MzEcKn9Q7wvL+

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1020	d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe
1020	d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1020	d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe
1020	d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe

C:\Users\Admin\AppData\Local\Temp\d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe
"C:\Users\Admin\AppData\Local\Temp\d1068ef6c7679906eff75cbb5eb8c93b51d0f1bee4f9d795ef14daf79cadd57a.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dfs35FF.tmp

Filesize
306KB

MD5
3ca0638e7119f63f2b6fc7426b3b0f8f

SHA1
fa699c3cb5ec74cfc8ebdade3a8a3dc014c29582

SHA256
82fcb7e72f5bee64eecbf9c1e553d65374951ffccaaa07d5848d624d732d40cf

SHA512
0769d88beb6fafe83bcc9176fc7892b8ba9c4a02be37129a57dc6513472b245179afea1abad161179414ef625890e1e8f6ac76d1d907887fe73f0ddb140e61e8

Download Submit
\Users\Admin\AppData\Local\Temp\dfs35FF.tmp

Filesize
306KB

MD5
3ca0638e7119f63f2b6fc7426b3b0f8f

SHA1
fa699c3cb5ec74cfc8ebdade3a8a3dc014c29582

SHA256
82fcb7e72f5bee64eecbf9c1e553d65374951ffccaaa07d5848d624d732d40cf

SHA512
0769d88beb6fafe83bcc9176fc7892b8ba9c4a02be37129a57dc6513472b245179afea1abad161179414ef625890e1e8f6ac76d1d907887fe73f0ddb140e61e8

Download Submit
memory/1020-56-0x00000000008C0000-0x0000000000912000-memory.dmp

Filesize
328KB

Download
memory/1020-57-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/1020-58-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1020-59-0x0000000004A67000-0x0000000004A78000-memory.dmp

Filesize
68KB

Download
memory/1020-60-0x000000000C320000-0x000000000CAC6000-memory.dmp

Filesize
7.6MB

Download