830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc

Analysis

max time kernel
22s
max time network
58s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-10-2022 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
Size

973KB
MD5

094a54af47e891733048b965263ee3e0
SHA1

74cbcd5da084d174444d936c04e7ee59d1cd52fb
SHA256

830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc
SHA512

31088e43df981d4de168c5f8807c6a0a1b365a59cc886de83df48919bdff0ce5bdaa435a790826783e62ab80dbc15b35c8b5d8a3ae05acd1079ca1a1ed545ef3
SSDEEP

24576:cblgRhXhAalAPW5Q6jtik2qtcVk6HdxALMOeemj9iYH:c2RLNXjQklcVv9x7nemRi

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\H:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\K:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\L:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\Q:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\S:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\T:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\J:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\N:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\O:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\X:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\E:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\I:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\W:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\Y:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\G:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\M:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\P:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\R:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\U:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\V:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
File opened (read-only)	\??\Z:	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
1652	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1652	830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe

C:\Users\Admin\AppData\Local\Temp\830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe
"C:\Users\Admin\AppData\Local\Temp\830404830e2887982d294d3a1500d533faccf73d509c6c7869d1e45c37b5a9dc.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download