834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890

Analysis

max time kernel
25s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 11:53

Target

834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe
Size

27KB
MD5

21218e4e7bad24e14de1a7d64faa8bc8
SHA1

6313d0701e078fd47d3b25242968107cbbbe2610
SHA256

834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890
SHA512

da284bbc543813e8ecab8757c697ef39cb2ce4f0bfca18f560795b53368a78367255c563b50ea3cc19d470353ac82390240c6032e0e942af45db4bc148e1aae6
SSDEEP

384:cQb9LYS/BKyRyWOScus0A0BhFmoDOICrUNrRcwoypGGvtbwGTJuomoUtGb7saW:vMC8rWOScusf0LFSYbUFGFbwGTJBNs

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1552	logo_1.exe

Deletes itself 1 IoCs

pid	Process
932	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe
1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\logo_1.exe	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe
File created	C:\Windows\system\logo_1.exe	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe
Token: SeDebugPrivilege	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1552	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	28
PID 1616 wrote to memory of 1552	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	28
PID 1616 wrote to memory of 1552	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	28
PID 1616 wrote to memory of 1552	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	28
PID 1616 wrote to memory of 932	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	29
PID 1616 wrote to memory of 932	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	29
PID 1616 wrote to memory of 932	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	29
PID 1616 wrote to memory of 932	1616	834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe	29

C:\Users\Admin\AppData\Local\Temp\834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe
"C:\Users\Admin\AppData\Local\Temp\834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\system\logo_1.exe
  C:\Windows\system\logo_1.exe /sleepDown
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\834189~1.EXE
  2⤵
  - Deletes itself
  PID:932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\system\logo_1.exe

Filesize
27KB

MD5
21218e4e7bad24e14de1a7d64faa8bc8

SHA1
6313d0701e078fd47d3b25242968107cbbbe2610

SHA256
834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890

SHA512
da284bbc543813e8ecab8757c697ef39cb2ce4f0bfca18f560795b53368a78367255c563b50ea3cc19d470353ac82390240c6032e0e942af45db4bc148e1aae6

Download Submit
\Windows\system\logo_1.exe

Filesize
27KB

MD5
21218e4e7bad24e14de1a7d64faa8bc8

SHA1
6313d0701e078fd47d3b25242968107cbbbe2610

SHA256
834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890

SHA512
da284bbc543813e8ecab8757c697ef39cb2ce4f0bfca18f560795b53368a78367255c563b50ea3cc19d470353ac82390240c6032e0e942af45db4bc148e1aae6

Download Submit
\Windows\system\logo_1.exe

Filesize
27KB

MD5
21218e4e7bad24e14de1a7d64faa8bc8

SHA1
6313d0701e078fd47d3b25242968107cbbbe2610

SHA256
834189858901cb39a08b5b3c69256b979dd78a30a68dbc93437cb433499a5890

SHA512
da284bbc543813e8ecab8757c697ef39cb2ce4f0bfca18f560795b53368a78367255c563b50ea3cc19d470353ac82390240c6032e0e942af45db4bc148e1aae6

Download Submit
memory/1552-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1552-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1616-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1616-61-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download