ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:33

Target

ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe
Size

1.1MB
MD5

17b588fd052c8a4ffaab849fe42fdd27
SHA1

7b8ed90b49e1d517ed7482e64d98a33ae64072a6
SHA256

ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea
SHA512

212661d19c4afd7f7e50ba5267daebac035f4b54c53b64bea7a6332e3afc0f4a731882fe0e2dad43ba4a915385c06bf8f1a29a0be8adf8e539edc3cf664583c0
SSDEEP

24576:24s8xAA5Ld0whqo/ETVObLV462NFbWCBqGQ/aPI975cSkAQ:24s8xAA5Ld0whqoGVORWJqGYx75uA

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1444	ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1444	ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe
1444	ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1444	ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe
1444	ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\ICReinstall_ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea.exe

Filesize
1.1MB

MD5
17b588fd052c8a4ffaab849fe42fdd27

SHA1
7b8ed90b49e1d517ed7482e64d98a33ae64072a6

SHA256
ab09dfbabb02e8f191ad3b255654d5f2e4ae03049f62412731c6178c950d28ea

SHA512
212661d19c4afd7f7e50ba5267daebac035f4b54c53b64bea7a6332e3afc0f4a731882fe0e2dad43ba4a915385c06bf8f1a29a0be8adf8e539edc3cf664583c0

Download Submit
memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1444-55-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1444-58-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download