Analysis
-
max time kernel
48s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 14:28
Static task
static1
Behavioral task
behavioral1
Sample
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe
-
Size
116KB
-
MD5
76c07e937622b4e5303ed5cfc1f0e580
-
SHA1
44721da1b241732e8474bbeca59e31c18e480c94
-
SHA256
90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d
-
SHA512
432653989d94bff9164f65a7adf62502a8b7a4ad2766bfcb9f5d617bef2c523d5778c4efff23c7a822707d5180067549c8b968c748f320d4d8dc966e4ca492a0
-
SSDEEP
3072:7wN6ym4zxz3jWzpDuzUjDzGDxziDbbSbUbNb3bhbwbdsaXCAyZK/zzazhACuzz+d:0kvssaXCkzzazhACuzz+cp0
Score
6/10
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1980 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1980 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1288 wrote to memory of 524 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 28 PID 1288 wrote to memory of 524 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 28 PID 1288 wrote to memory of 524 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 28 PID 1288 wrote to memory of 524 1288 90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe 28 PID 524 wrote to memory of 1980 524 cmd.exe 30 PID 524 wrote to memory of 1980 524 cmd.exe 30 PID 524 wrote to memory of 1980 524 cmd.exe 30 PID 524 wrote to memory of 1980 524 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe"C:\Users\Admin\AppData\Local\Temp\90d13ac02c84c6e518a96d480874999a69c9063fa6ca9aea54511b0d8c970b7d.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 90d13ac02c84c6e518a96d480874999a692⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-