98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934

Analysis

max time kernel
60s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-10-2022 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
Size

908KB
MD5

117f5f5a40175e5b63b937fa63645ca5
SHA1

715119d908b7101e9797166e6f5d1438e2a51df2
SHA256

98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934
SHA512

3d08e067ab0f6ff730bd5cdcbf6a3b20a546a8b401abbe23b059f810e3f82aed208908673d552774482ac93f9c3373ccb4fca97b5e99afd78ef8f6800ea3fe61
SSDEEP

24576:k5Xf3yEvbZQGACw+RtY/+TVJIsK/BJt977B:CXfyEvqYY+ToX977B

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe

description pid process

Token: SeDebugPrivilege 1528 98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe

description	pid	process
Token: SeDebugPrivilege	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe

description	pid	process	target process
PID 1528 wrote to memory of 2040	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
PID 1528 wrote to memory of 2040	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
PID 1528 wrote to memory of 2040	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
PID 1528 wrote to memory of 2040	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
PID 1528 wrote to memory of 1988	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	WScript.exe
PID 1528 wrote to memory of 1988	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	WScript.exe
PID 1528 wrote to memory of 1988	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	WScript.exe
PID 1528 wrote to memory of 1988	1528	98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
"C:\Users\Admin\AppData\Local\Temp\98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\AppData\Local\Temp\98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
C:\Users\Admin\AppData\Local\Temp\98f8775972ce2b704de74a952c53101a4d42f777ba1214db227985adcf12c934.exe
2⤵
PID:2040

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\TQVpU.vbs"
2⤵
PID:1988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\TQVpU.vbs
Filesize
405B

MD5
e21132623922d2cab65c23c96e98604c

SHA1
f7f5f21b5c60cd336ed29b34105a1a1c0b1511e0

SHA256
c122216673b3d72f2b53ffb3f888e3d14794db3df729b9e8638901cdb5fdb6f7

SHA512
f173c2f3596b4f2a0d9c24107b6bab034a4edda63182f1239fceb8938df65debdad40baab15b65c2d6fcf69f2cde0de4507ae9aaf45cb51b7013bdd0ed9e1e12

Download Submit
memory/1528-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1528-55-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1528-59-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1988-56-0x0000000000000000-mapping.dmp

Download