Analysis
- max time kernel
47s - max time network
33s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
19/11/2022, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
a5d90c7d3e393ee48132480fca1532cf.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
General
- Target a5d90c7d3e393ee48132480fca1532cf.exe
- Size 2.3MB
- Sample221119-e4tcgadf29
- SHA256 7bd46b7c65926d301ef6d867258e13c68e9f6c8fc721cc541cf084aa0df47133
- MD5 a5d90c7d3e393ee48132480fca1532cf
- SHA1 7c533f9f322a6efd50de5e1c3551571eccf0f408
- SHA512 0e5b577e128dfc20878737e7cace196e9e8cd9784d3451162aaf6cb577efd0c96d96bed9b2e158e14f67de96697c6eca1ad0706fb20481d09c8a071afdd78912
- SSDEEP 49152:8Uscf2YXnRNaqzu2yghkAwwpLTKrRMVl4pVYW17x:K8LD7pXWMTy17x
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fiyjdwaazb = "\"C:\\Users\\Admin\\AppData\\Roaming\\Fkgfqcjzll\\Fiyjdwaazb.exe\"" a5d90c7d3e393ee48132480fca1532cf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1272 powershell.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe 1320 a5d90c7d3e393ee48132480fca1532cf.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1320 a5d90c7d3e393ee48132480fca1532cf.exe Token: SeDebugPrivilege 1272 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1272 1320 a5d90c7d3e393ee48132480fca1532cf.exe 28 PID 1320 wrote to memory of 1272 1320 a5d90c7d3e393ee48132480fca1532cf.exe 28 PID 1320 wrote to memory of 1272 1320 a5d90c7d3e393ee48132480fca1532cf.exe 28 PID 1320 wrote to memory of 1272 1320 a5d90c7d3e393ee48132480fca1532cf.exe 28 PID 1320 wrote to memory of 320 1320 a5d90c7d3e393ee48132480fca1532cf.exe 30 PID 1320 wrote to memory of 320 1320 a5d90c7d3e393ee48132480fca1532cf.exe 30 PID 1320 wrote to memory of 320 1320 a5d90c7d3e393ee48132480fca1532cf.exe 30 PID 1320 wrote to memory of 320 1320 a5d90c7d3e393ee48132480fca1532cf.exe 30 PID 1320 wrote to memory of 320 1320 a5d90c7d3e393ee48132480fca1532cf.exe 30 PID 1320 wrote to memory of 320 1320 a5d90c7d3e393ee48132480fca1532cf.exe 30 PID 1320 wrote to memory of 320 1320 a5d90c7d3e393ee48132480fca1532cf.exe 30 PID 1320 wrote to memory of 1104 1320 a5d90c7d3e393ee48132480fca1532cf.exe 31 PID 1320 wrote to memory of 1104 1320 a5d90c7d3e393ee48132480fca1532cf.exe 31 PID 1320 wrote to memory of 1104 1320 a5d90c7d3e393ee48132480fca1532cf.exe 31 PID 1320 wrote to memory of 1104 1320 a5d90c7d3e393ee48132480fca1532cf.exe 31 PID 1320 wrote to memory of 1104 1320 a5d90c7d3e393ee48132480fca1532cf.exe 31 PID 1320 wrote to memory of 1104 1320 a5d90c7d3e393ee48132480fca1532cf.exe 31 PID 1320 wrote to memory of 1104 1320 a5d90c7d3e393ee48132480fca1532cf.exe 31 PID 1320 wrote to memory of 696 1320 a5d90c7d3e393ee48132480fca1532cf.exe 32 PID 1320 wrote to memory of 696 1320 a5d90c7d3e393ee48132480fca1532cf.exe 32 PID 1320 wrote to memory of 696 1320 a5d90c7d3e393ee48132480fca1532cf.exe 32 PID 1320 wrote to memory of 696 1320 a5d90c7d3e393ee48132480fca1532cf.exe 32 PID 1320 wrote to memory of 696 1320 a5d90c7d3e393ee48132480fca1532cf.exe 32 PID 1320 wrote to memory of 696 1320 a5d90c7d3e393ee48132480fca1532cf.exe 32 PID 1320 wrote to memory of 696 1320 a5d90c7d3e393ee48132480fca1532cf.exe 32 PID 1320 wrote to memory of 1356 1320 a5d90c7d3e393ee48132480fca1532cf.exe 33 PID 1320 wrote to memory of 1356 1320 a5d90c7d3e393ee48132480fca1532cf.exe 33 PID 1320 wrote to memory of 1356 1320 a5d90c7d3e393ee48132480fca1532cf.exe 33 PID 1320 wrote to memory of 1356 1320 a5d90c7d3e393ee48132480fca1532cf.exe 33 PID 1320 wrote to memory of 1356 1320 a5d90c7d3e393ee48132480fca1532cf.exe 33 PID 1320 wrote to memory of 1356 1320 a5d90c7d3e393ee48132480fca1532cf.exe 33 PID 1320 wrote to memory of 1356 1320 a5d90c7d3e393ee48132480fca1532cf.exe 33 PID 1320 wrote to memory of 1756 1320 a5d90c7d3e393ee48132480fca1532cf.exe 34 PID 1320 wrote to memory of 1756 1320 a5d90c7d3e393ee48132480fca1532cf.exe 34 PID 1320 wrote to memory of 1756 1320 a5d90c7d3e393ee48132480fca1532cf.exe 34 PID 1320 wrote to memory of 1756 1320 a5d90c7d3e393ee48132480fca1532cf.exe 34 PID 1320 wrote to memory of 1756 1320 a5d90c7d3e393ee48132480fca1532cf.exe 34 PID 1320 wrote to memory of 1756 1320 a5d90c7d3e393ee48132480fca1532cf.exe 34 PID 1320 wrote to memory of 1756 1320 a5d90c7d3e393ee48132480fca1532cf.exe 34 PID 1320 wrote to memory of 1960 1320 a5d90c7d3e393ee48132480fca1532cf.exe 35 PID 1320 wrote to memory of 1960 1320 a5d90c7d3e393ee48132480fca1532cf.exe 35 PID 1320 wrote to memory of 1960 1320 a5d90c7d3e393ee48132480fca1532cf.exe 35 PID 1320 wrote to memory of 1960 1320 a5d90c7d3e393ee48132480fca1532cf.exe 35 PID 1320 wrote to memory of 1960 1320 a5d90c7d3e393ee48132480fca1532cf.exe 35 PID 1320 wrote to memory of 1960 1320 a5d90c7d3e393ee48132480fca1532cf.exe 35 PID 1320 wrote to memory of 1960 1320 a5d90c7d3e393ee48132480fca1532cf.exe 35 PID 1320 wrote to memory of 1700 1320 a5d90c7d3e393ee48132480fca1532cf.exe 36 PID 1320 wrote to memory of 1700 1320 a5d90c7d3e393ee48132480fca1532cf.exe 36 PID 1320 wrote to memory of 1700 1320 a5d90c7d3e393ee48132480fca1532cf.exe 36 PID 1320 wrote to memory of 1700 1320 a5d90c7d3e393ee48132480fca1532cf.exe 36 PID 1320 wrote to memory of 1700 1320 a5d90c7d3e393ee48132480fca1532cf.exe 36 PID 1320 wrote to memory of 1700 1320 a5d90c7d3e393ee48132480fca1532cf.exe 36 PID 1320 wrote to memory of 1700 1320 a5d90c7d3e393ee48132480fca1532cf.exe 36 PID 1320 wrote to memory of 968 1320 a5d90c7d3e393ee48132480fca1532cf.exe 37 PID 1320 wrote to memory of 968 1320 a5d90c7d3e393ee48132480fca1532cf.exe 37 PID 1320 wrote to memory of 968 1320 a5d90c7d3e393ee48132480fca1532cf.exe 37 PID 1320 wrote to memory of 968 1320 a5d90c7d3e393ee48132480fca1532cf.exe 37 PID 1320 wrote to memory of 968 1320 a5d90c7d3e393ee48132480fca1532cf.exe 37 PID 1320 wrote to memory of 968 1320 a5d90c7d3e393ee48132480fca1532cf.exe 37 PID 1320 wrote to memory of 968 1320 a5d90c7d3e393ee48132480fca1532cf.exe 37 PID 1320 wrote to memory of 1424 1320 a5d90c7d3e393ee48132480fca1532cf.exe 38 PID 1320 wrote to memory of 1424 1320 a5d90c7d3e393ee48132480fca1532cf.exe 38 PID 1320 wrote to memory of 1424 1320 a5d90c7d3e393ee48132480fca1532cf.exe 38 PID 1320 wrote to memory of 1424 1320 a5d90c7d3e393ee48132480fca1532cf.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe"C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:320
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:1356
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:1960
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:968
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:1424
-
-
C:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exeC:\Users\Admin\AppData\Local\Temp\a5d90c7d3e393ee48132480fca1532cf.exe2⤵PID:1852
-