ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2

Analysis

max time kernel
151s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe
Size

939KB
MD5

805d136101687e583dfc146a6b45ff60
SHA1

0d0a5ef078c509ca32e3877ee2f9b8572abdd9e9
SHA256

ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2
SHA512

5a7bb10f9cb3f62b8835adfb9053442ed1b36c2b5aa9c4b650bf40838429d38a59c0dcba7a5bcd1e92c3675a496b3e3f18eab5c86d7729e08023afc72866a572
SSDEEP

24576:3RmJkcoQricOIQxiZY1iaiTqv9xcvGgoP:8JZoQrbTFZY1iaiTqvLPga

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2008	AcroRd32.exe
2008	AcroRd32.exe
2008	AcroRd32.exe
2008	AcroRd32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 900	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	28
PID 1692 wrote to memory of 900	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	28
PID 1692 wrote to memory of 900	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	28
PID 1692 wrote to memory of 900	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	28
PID 900 wrote to memory of 2008	900	cmd.exe	30
PID 900 wrote to memory of 2008	900	cmd.exe	30
PID 900 wrote to memory of 2008	900	cmd.exe	30
PID 900 wrote to memory of 2008	900	cmd.exe	30
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31
PID 1692 wrote to memory of 1936	1692	ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe	31

C:\Users\Admin\AppData\Local\Temp\ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe
"C:\Users\Admin\AppData\Local\Temp\ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C Start C:\Users\Admin\AppData\Local\Temp\580449\FILEPD~1.PDF
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\580449\FILE.PDF.pdf"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2008
- C:\Users\Admin\AppData\Local\Temp\ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe
  "C:\Users\Admin\AppData\Local\Temp\ef8910a7a4574b6111bccad87565739559527a7819b059a46a332d38885544c2.exe"
  2⤵
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\580449\FILE.PDF.pdf

Filesize
934B

MD5
2d5fb5d0e065bb36e3215f7112974047

SHA1
b2d93d366e67dc2975adf2d4f6dfdb0c3b67808a

SHA256
46906cf195855b0d1c04fca87fad5252c6f77dba84744bb195d5338f4540b558

SHA512
8d05745883f420bca6664b73112de682ebba89e6ea013e38cc7a2944354fecc1a3ee3893ad04f01444b5f33f9edeccfdedfad07196a44d2df6c7cd2cf49118bb

Download Submit
memory/1692-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1936-61-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1936-60-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1936-64-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1936-63-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1936-66-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1936-70-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download