f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4

Analysis

max time kernel
148s
max time network
157s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe
Size

556KB
MD5

839d4f4798f10ce9766d0fee97136810
SHA1

9e95b845a8a1a8769af63d218697394ac7ff6927
SHA256

f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4
SHA512

8c22e1ed94c6726f944682a734f5eb6452e0acd365133fcf9e09dd7a6a9e25239ad4a81c5c3169d852ab27ac1524f97764abd768a75beaeb73a0a963037316e2
SSDEEP

6144:aN73TeVbl0ZnF0y6oSOtrHX6H5wITUXj/MBZEcmUbPl6d1i2QqQwv4iYS:ySP0ZnFhtSO05ZQj/MzEcKn9Q7wvX

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1300	f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe
1300	f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1300	f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe
1300	f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe

C:\Users\Admin\AppData\Local\Temp\f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe
"C:\Users\Admin\AppData\Local\Temp\f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dfs1D90.tmp

Filesize
306KB

MD5
3ca0638e7119f63f2b6fc7426b3b0f8f

SHA1
fa699c3cb5ec74cfc8ebdade3a8a3dc014c29582

SHA256
82fcb7e72f5bee64eecbf9c1e553d65374951ffccaaa07d5848d624d732d40cf

SHA512
0769d88beb6fafe83bcc9176fc7892b8ba9c4a02be37129a57dc6513472b245179afea1abad161179414ef625890e1e8f6ac76d1d907887fe73f0ddb140e61e8

Download Submit
\Users\Admin\AppData\Local\Temp\dfs1D90.tmp

Filesize
306KB

MD5
3ca0638e7119f63f2b6fc7426b3b0f8f

SHA1
fa699c3cb5ec74cfc8ebdade3a8a3dc014c29582

SHA256
82fcb7e72f5bee64eecbf9c1e553d65374951ffccaaa07d5848d624d732d40cf

SHA512
0769d88beb6fafe83bcc9176fc7892b8ba9c4a02be37129a57dc6513472b245179afea1abad161179414ef625890e1e8f6ac76d1d907887fe73f0ddb140e61e8

Download Submit
memory/1300-56-0x0000000001F60000-0x0000000001FB2000-memory.dmp

Filesize
328KB

Download
memory/1300-57-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download
memory/1300-58-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1300-59-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/1300-60-0x000000000C3F0000-0x000000000CB96000-memory.dmp

Filesize
7.6MB

Download
memory/1300-61-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download