Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe
-
Size
106KB
-
MD5
a2365d15de79bda664442a7576655910
-
SHA1
f84e881354b212cbacd54676649d13835ece2bd8
-
SHA256
0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4
-
SHA512
1916e82d84c3c79ef57dc5a18bb815c6a419780d0e58f8a75103e17b78d821a12cb3c509e705451f2edc9d829bdc9c7afe5114c12954a80039041487b311ea16
-
SSDEEP
1536:bdZAaaIp5omMPRd+11JhyO4EsI05NxgJrI3X+GfIDVib:qmMJd+1AP3XhG
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 992 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1800 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1668 wrote to memory of 992 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 28 PID 1668 wrote to memory of 992 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 28 PID 1668 wrote to memory of 992 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 28 PID 1668 wrote to memory of 992 1668 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe 28 PID 992 wrote to memory of 1800 992 cmd.exe 30 PID 992 wrote to memory of 1800 992 cmd.exe 30 PID 992 wrote to memory of 1800 992 cmd.exe 30 PID 992 wrote to memory of 1800 992 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe"C:\Users\Admin\AppData\Local\Temp\0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 0a4ecd0d2827c57c609d1899f0eb0be0bb3b26b046ea8bf6a283c5d9829e1dc4.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-