Analysis
-
max time kernel
145s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe
Resource
win10v2004-20220812-en
General
-
Target
89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe
-
Size
597KB
-
MD5
8102b44bf1fec0d45dbf877b225c40b0
-
SHA1
374535ff48daa4eda5c2ac1c76e6dc1a075260af
-
SHA256
89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6
-
SHA512
858b06615be46be78098766381724e58e3a449a5bd6ed533627d61f36a2b91d45bbfe87da059e6f476a70a5d470c84767488eb5d1cc271b79f512958400b74f7
-
SSDEEP
12288:QnvpSu/qBIUxUwicfzGJeINbD3V5GaJDp/:QnvUGRwhSJ3Jtp
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1600-132-0x0000000002240000-0x0000000002372000-memory.dmp upx behavioral2/memory/1600-135-0x0000000002240000-0x0000000002372000-memory.dmp upx behavioral2/memory/1600-136-0x0000000002240000-0x0000000002372000-memory.dmp upx behavioral2/memory/1600-139-0x0000000002240000-0x0000000002372000-memory.dmp upx behavioral2/memory/1600-140-0x0000000002240000-0x0000000002372000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe Token: SeCreatePagefilePrivilege 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe 1600 89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe"C:\Users\Admin\AppData\Local\Temp\89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1600