Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 02:35
Static task
static1
Behavioral task
behavioral1
Sample
da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe
-
Size
76KB
-
MD5
488522ebadb910ef0dc31914803a1790
-
SHA1
b9dc41c96e65d22a58ac5aae9d0ba399749d0b5e
-
SHA256
da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306
-
SHA512
9ad8e3d86b0ec653c430527fbdded7ea562d4def3c2fb2f555a0c7d9a2c6b9961ce61f3b580d5e7f4f4f97877ee7b656afbe3feb9bc651a008c94bb8fa0f9bcd
-
SSDEEP
768:w/SdTwq/08wF10BXu6+Y/GtFmANEKVKg3Bz4CHl/4EdKXy8BOyfw:w/SdqmeiANESKgxUqZYBOyI
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1820 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 748 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 748 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1820 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 28 PID 1752 wrote to memory of 1820 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 28 PID 1752 wrote to memory of 1820 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 28 PID 1752 wrote to memory of 1820 1752 da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe 28 PID 1820 wrote to memory of 748 1820 cmd.exe 30 PID 1820 wrote to memory of 748 1820 cmd.exe 30 PID 1820 wrote to memory of 748 1820 cmd.exe 30 PID 1820 wrote to memory of 748 1820 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe"C:\Users\Admin\AppData\Local\Temp\da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del da53de7f04899786245d8d553d257f55d6bfbb309145e1119e29a58501925306.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-