c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275

Analysis

max time kernel
69s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe
Size

116KB
MD5

77301eb9a78fdce3c8fd345c21b171b1
SHA1

acb7b317282f4f7780cd6ba19818d975bb93239a
SHA256

c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275
SHA512

cd0b5fc52619574d2287a0122324ed52519f30541096c0c438f54b27c156fbd578f4abcdb9dc394b8a641a6fd8957a8a4463556349a245091d7d94bbd979d750
SSDEEP

1536:OyuNt9gDpbEOEiDfowwqcQgduffFYfOv:RimhEOEiDfoLqcJefFb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1548	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1436	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1408	c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe
1408	c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1548	1408	c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe	29
PID 1408 wrote to memory of 1548	1408	c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe	29
PID 1408 wrote to memory of 1548	1408	c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe	29
PID 1408 wrote to memory of 1548	1408	c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe	29
PID 1548 wrote to memory of 1436	1548	cmd.exe	31
PID 1548 wrote to memory of 1436	1548	cmd.exe	31
PID 1548 wrote to memory of 1436	1548	cmd.exe	31
PID 1548 wrote to memory of 1436	1548	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe
"C:\Users\Admin\AppData\Local\Temp\c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del c17274a1257db2b29dca042cd7535840538e579dc1e506563b1e0fa82a526275.exe
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-57-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download