46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
Size

580KB
MD5

1e283ddd5b96096c8c2f1aa332b0dd20
SHA1

16cf1153e04916133b7ca9653ba04f19b2ed1e82
SHA256

46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da
SHA512

97e199969916e943f2bd56bc8e62dfc9e5a780070a0a1afedd5f6660de1d183dc466f2b11bfce2eb0cdab369b4474df34e9f2b26be2c5211a15b90f5660bc411
SSDEEP

6144:BZZBq1Yn95WTdFnVWdZjFPQ/XkjMBZzInh/FbMYLhcUgYfpjHkB2ZI+AuSJmqz:BJq4sFnsLi/XkjctcyylHo2++ABJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 368	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	5
PID 1752 wrote to memory of 368	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	5
PID 1752 wrote to memory of 368	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	5
PID 1752 wrote to memory of 368	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	5
PID 1752 wrote to memory of 368	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	5
PID 1752 wrote to memory of 368	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	5
PID 1752 wrote to memory of 376	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	4
PID 1752 wrote to memory of 376	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	4
PID 1752 wrote to memory of 376	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	4
PID 1752 wrote to memory of 376	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	4
PID 1752 wrote to memory of 376	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	4
PID 1752 wrote to memory of 376	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	4
PID 1752 wrote to memory of 416	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	3
PID 1752 wrote to memory of 416	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	3
PID 1752 wrote to memory of 416	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	3
PID 1752 wrote to memory of 416	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	3
PID 1752 wrote to memory of 416	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	3
PID 1752 wrote to memory of 416	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	3
PID 1752 wrote to memory of 460	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	2
PID 1752 wrote to memory of 460	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	2
PID 1752 wrote to memory of 460	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	2
PID 1752 wrote to memory of 460	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	2
PID 1752 wrote to memory of 460	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	2
PID 1752 wrote to memory of 460	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	2
PID 1752 wrote to memory of 476	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	1
PID 1752 wrote to memory of 476	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	1
PID 1752 wrote to memory of 476	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	1
PID 1752 wrote to memory of 476	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	1
PID 1752 wrote to memory of 476	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	1
PID 1752 wrote to memory of 476	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	1
PID 1752 wrote to memory of 484	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	8
PID 1752 wrote to memory of 484	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	8
PID 1752 wrote to memory of 484	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	8
PID 1752 wrote to memory of 484	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	8
PID 1752 wrote to memory of 484	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	8
PID 1752 wrote to memory of 484	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	8
PID 1752 wrote to memory of 596	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	27
PID 1752 wrote to memory of 596	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	27
PID 1752 wrote to memory of 596	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	27
PID 1752 wrote to memory of 596	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	27
PID 1752 wrote to memory of 596	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	27
PID 1752 wrote to memory of 596	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	27
PID 1752 wrote to memory of 672	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	26
PID 1752 wrote to memory of 672	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	26
PID 1752 wrote to memory of 672	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	26
PID 1752 wrote to memory of 672	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	26
PID 1752 wrote to memory of 672	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	26
PID 1752 wrote to memory of 672	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	26
PID 1752 wrote to memory of 724	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	25
PID 1752 wrote to memory of 724	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	25
PID 1752 wrote to memory of 724	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	25
PID 1752 wrote to memory of 724	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	25
PID 1752 wrote to memory of 724	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	25
PID 1752 wrote to memory of 724	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	25
PID 1752 wrote to memory of 812	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	24
PID 1752 wrote to memory of 812	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	24
PID 1752 wrote to memory of 812	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	24
PID 1752 wrote to memory of 812	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	24
PID 1752 wrote to memory of 812	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	24
PID 1752 wrote to memory of 812	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	24
PID 1752 wrote to memory of 844	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	23
PID 1752 wrote to memory of 844	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	23
PID 1752 wrote to memory of 844	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	23
PID 1752 wrote to memory of 844	1752	46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe	23

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1056
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1996
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1832
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1128
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:656
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:880
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:724
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1328

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1988

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe
  "C:\Users\Admin\AppData\Local\Temp\46fac72015b18ade821c89818e072f3a1f9d3e62d62e7d9ca5d69468007963da.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1752

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1752-55-0x0000000074A81000-0x0000000074A83000-memory.dmp

Filesize
8KB

Download
memory/1752-56-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download