db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe
Size

84KB
MD5

84701820e1a78faba9ac1e5d62f152e0
SHA1

53b7d72d86c0e956f5ac6be3c127093a902f46c1
SHA256

db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d
SHA512

8cfb931faee7a189b16c1f051c7c2dc8247b75297d6842a91199ee24b0f87046ee60aeca82b870fbe6aeadb85043406396cd69fbcf8e12952d09600f04d68260
SSDEEP

768:PviMZb/rGUz3Nribdf1ZEncJcZ0TSdFFeDF3RqmtjOfIU3OngkMjtsjxfcpm:PaMIU3JUA0AFdooRKjxUm

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
940	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe
1600	db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1740	1600	db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe	29
PID 1600 wrote to memory of 1740	1600	db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe	29
PID 1600 wrote to memory of 1740	1600	db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe	29
PID 1600 wrote to memory of 1740	1600	db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe	29
PID 1740 wrote to memory of 940	1740	cmd.exe	31
PID 1740 wrote to memory of 940	1740	cmd.exe	31
PID 1740 wrote to memory of 940	1740	cmd.exe	31
PID 1740 wrote to memory of 940	1740	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe
"C:\Users\Admin\AppData\Local\Temp\db7d03d6085a91997c9bfc0c68b4a58bacad1720ee9c35e3fdf5a291f1a56c1d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del db7d03d6085a91997c9bfc0c68b4a58bac
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-57-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download