Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe
-
Size
92KB
-
MD5
8320554ebfa8c9ba269b68af2e827e87
-
SHA1
643fae6cbdf78628224dc541413fe49ea7ca7369
-
SHA256
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82
-
SHA512
bdff9447d4725deca2b5800b5ff7c02a045772891d5db2beff6ebf6e408d49a7a7bca4cae252dd14ec44c7081c7ab8c131549cc4fefd4c55e04eeb231864df66
-
SSDEEP
768:K99XHugT0lvlq/P1vwwrnkjBt1ZJk8vK8GSdrD9wGy241ZUb/CxhYLJP30UOEGaK:+5PuB7mUbaxeLd4IfmkBwC8BD+KBq2x
Score
6/10
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1528 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1528 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1912 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 29 PID 1632 wrote to memory of 1912 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 29 PID 1632 wrote to memory of 1912 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 29 PID 1632 wrote to memory of 1912 1632 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 29 PID 1912 wrote to memory of 1528 1912 cmd.exe 31 PID 1912 wrote to memory of 1528 1912 cmd.exe 31 PID 1912 wrote to memory of 1528 1912 cmd.exe 31 PID 1912 wrote to memory of 1528 1912 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe"C:\Users\Admin\AppData\Local\Temp\1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 1f6a5c1a362037418ea29817b2b004fedd2⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-