673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327

Analysis

max time kernel
65s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 05:33

Target

673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exe
Size

92KB
MD5

c10f6d5aacd966fb369949187fb5578e
SHA1

4c2aacca66c1db77774b555cac2b2cd8b98babf3
SHA256

673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327
SHA512

430378ad1e4cdda0c8f288e1e542a563f6e4632e82e567898578402e0a3aabb8a85291b94a3da5bbc29629f359f5dad037347036b097eb10ea9e530bae0faf4c
SSDEEP

384:jpuwCpGGRf1FbjJVffCCIIJooZXXXMMLW/:nkbj3ffvIIJooo

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2284 powershell.exe

pid	process
2284	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1476	673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exe
Token: SeDebugPrivilege	2284	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exe

description	pid	process	target process
PID 1476 wrote to memory of 2284	1476	673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exe	powershell.exe
PID 1476 wrote to memory of 2284	1476	673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exe	powershell.exe
PID 1476 wrote to memory of 2284	1476	673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exe	powershell.exe
PID 1476 wrote to memory of 2284	1476	673129a6b96275e72e01545fb8da52f2e6dd1cd05b49c8a6224b22cc04777327.exe	powershell.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1476-54-0x0000000000DB0000-0x0000000000DCC000-memory.dmp

Filesize
112KB

Download
memory/1476-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1476-56-0x0000000007350000-0x000000000772C000-memory.dmp

Filesize
3.9MB

Download
memory/2284-57-0x0000000000000000-mapping.dmp

Download
memory/2284-59-0x000000006DD20000-0x000000006E2CB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-60-0x000000006DD20000-0x000000006E2CB000-memory.dmp

Filesize
5.7MB

Download