Overview

overview

10

Static

static

3056792cfe...5f.exe

windows7-x64

6

3056792cfe...5f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    58s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-10-2022 10:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3056792cfe11d96217fa3626f3ab6a5f.exe

  • Size

    4.6MB

  • MD5

    3056792cfe11d96217fa3626f3ab6a5f

  • SHA1

    d2b732a35d22e32dbc265957e624c667012a6a18

  • SHA256

    02db00ca3d50065b6c10c027a64066d00d4a1cd8dbed0b77ce414a64258406f5

  • SHA512

    c7e217193294760af3bfb12ff4e7ed327faf9ba09e05d3927eaba26385ce9853ff42685cdabff00fbe6c1461ce5c772afc7a158d72da9e33039da0ee828789c8

  • SSDEEP

    24576:2RlFlAOYfBKbQzW3I+ps4NCmntjDesG5InScdbJaP1tVpVzKGeGCvCr2F1xgLAZ4:

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
    "C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:612
    • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
      C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
      2⤵
        PID:784
      • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
        C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
        2⤵
          PID:772
        • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
          C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
          2⤵
            PID:660
          • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
            C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
            2⤵
              PID:688
            • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
              C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
              2⤵
                PID:1324
              • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                2⤵
                  PID:1944
                • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                  C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                  2⤵
                    PID:916
                  • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                    C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                    2⤵
                      PID:1844
                    • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                      C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                      2⤵
                        PID:600
                      • C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                        C:\Users\Admin\AppData\Local\Temp\3056792cfe11d96217fa3626f3ab6a5f.exe
                        2⤵
                          PID:1708

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/612-58-0x0000000000000000-mapping.dmp

                        Download

                      • memory/612-59-0x0000000076171000-0x0000000076173000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/612-60-0x000000006FE10000-0x00000000703BB000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/612-61-0x000000006FE10000-0x00000000703BB000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/612-62-0x000000006FE10000-0x00000000703BB000-memory.dmp

                        Filesize

                        5.7MB

                        Download

                      • memory/1048-54-0x0000000000130000-0x00000000005CE000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1048-55-0x0000000005DD0000-0x0000000006020000-memory.dmp

                        Filesize

                        2.3MB

                        Download

                      • memory/1048-56-0x0000000006300000-0x0000000006506000-memory.dmp

                        Filesize

                        2.0MB

                        Download

                      • memory/1048-57-0x0000000000A70000-0x0000000000B02000-memory.dmp

                        Filesize

                        584KB

                        Download