Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-10-2022 21:01
Static task
static1
Behavioral task
behavioral1
Sample
801acd1c8e0280b31e28c726f6b427a4.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
801acd1c8e0280b31e28c726f6b427a4.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
801acd1c8e0280b31e28c726f6b427a4.exe
-
Size
363KB
-
MD5
801acd1c8e0280b31e28c726f6b427a4
-
SHA1
d83262e6081da951918dfa5121814bb82e95a269
-
SHA256
67d15967c6afc53889aa22cad18fd6afccff7a4e513e218478f882fb01824dd4
-
SHA512
39aad4426232681419d5d15ce061767fff5b2d3b25076ebe07a2cb0c6593b75dfb44d91e2ecc40dfde7ef1b8e9b643c25c22feaa89807ca9cd476f1a76782dae
-
SSDEEP
3072:vWlhCuAo4LsUokIau9UUsnz+NSMfD9H5+EKj:ulhCuF4LTu9xsniNS4Dr8
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 880 conhost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 816 set thread context of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 564 set thread context of 880 564 AppLaunch.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1416 powershell.exe 816 801acd1c8e0280b31e28c726f6b427a4.exe 816 801acd1c8e0280b31e28c726f6b427a4.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 816 801acd1c8e0280b31e28c726f6b427a4.exe Token: SeDebugPrivilege 1416 powershell.exe Token: SeLockMemoryPrivilege 880 conhost.exe Token: SeLockMemoryPrivilege 880 conhost.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe 880 conhost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 816 wrote to memory of 1416 816 801acd1c8e0280b31e28c726f6b427a4.exe 27 PID 816 wrote to memory of 1416 816 801acd1c8e0280b31e28c726f6b427a4.exe 27 PID 816 wrote to memory of 1416 816 801acd1c8e0280b31e28c726f6b427a4.exe 27 PID 816 wrote to memory of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 816 wrote to memory of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 816 wrote to memory of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 816 wrote to memory of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 816 wrote to memory of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 816 wrote to memory of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 816 wrote to memory of 564 816 801acd1c8e0280b31e28c726f6b427a4.exe 29 PID 564 wrote to memory of 880 564 AppLaunch.exe 31 PID 564 wrote to memory of 880 564 AppLaunch.exe 31 PID 564 wrote to memory of 880 564 AppLaunch.exe 31 PID 564 wrote to memory of 880 564 AppLaunch.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\801acd1c8e0280b31e28c726f6b427a4.exe"C:\Users\Admin\AppData\Local\Temp\801acd1c8e0280b31e28c726f6b427a4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe qeqkbjctbfy0 6E3sjfZq2rJQaxvLPmXgsLqz8lpJ63UklPJg9pmcWSo8Jq3kZKSmvY4+NRTnUpEE3r7+XdtDimsNE7e/g+L2X9H56A5oEjJPagfD7QnT15zaBaj0uazjcA0XmidLhgHPgbFsB3e7l3mh+HQxK0IgPyO5BCIyV/0dj7UBA5qbtnhvEysue9hfOHc3u05LtSAbyLevTJdM29MLupiky3fBB4f7gpKX6SCprT+ftxtOrV1jVTSOVeWYw0PtiKcCojqtEffJsh4ZUZhRRWjAF9vtd6YAerLXuvJWihYiYwUI6cKGgNXX6Rp/oTqNMRDOeX5AHhUEpGHVpRjSu8gA7guRnSgqQBDeAJf0DVOipCGNM4wBWTFxmErarlh1DfOgRL8t3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:880
-
-