Analysis
-
max time kernel
188s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:29
General
-
Target
698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884.exe
-
Size
614KB
-
MD5
1e3f25d4d96c1b24c49ea04eb29d1c49
-
SHA1
8ba18af7c275a34ef4b24a6a0acfe6720c62a833
-
SHA256
698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884
-
SHA512
ffae5e6cbff554dc228242c0d98408b88b5c90310d80df271ac4d2193d8066d0b4a8f3bde71ffd12ebb5eea59ac09c9cd01f0bd933de3562352de46b953dfe2f
-
SSDEEP
12288:jCfnJXGT+2d7wfraS72bQDiF31ak8UVFS31Fj+y8R6NtZSPTu7:jOJBEcTaS72btjakVuGktg7u
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884.exe"C:\Users\Admin\AppData\Local\Temp\698ec2389e5bd6de6d5083337bf2d53d151fdf3bc39ecaad96e2a96239ce0884.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe"C:\Users\Admin\AppData\Local\Temp\Ä»¸®½«¾üµÄÍ·¹ÇÐÞ¸ÄÆ÷.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5a1bba35c752b36f575350cb7ddf238e4
SHA19603b691ae71d4fbc7a14dbb837bd97cecac8aab
SHA2560667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6
SHA512eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
789KB
MD5cac807502e0fc885f5a40374d5de03cb
SHA1d1d945e2dcbf6c8a05b498d37d7a705a8f042773
SHA256026d5b51aaf8f8886bf470f33e4ba26dfa23b305afb216c638dc8213a0399eec
SHA512ba0a83caeba2395e616a8113dad1292f48e212a367352f492e4fd3388816709c51226a712befebbdef9e6dfd006f017ed54d4f89a313cf4a76ff0b070b39aa17
-
Filesize
789KB
MD5cac807502e0fc885f5a40374d5de03cb
SHA1d1d945e2dcbf6c8a05b498d37d7a705a8f042773
SHA256026d5b51aaf8f8886bf470f33e4ba26dfa23b305afb216c638dc8213a0399eec
SHA512ba0a83caeba2395e616a8113dad1292f48e212a367352f492e4fd3388816709c51226a712befebbdef9e6dfd006f017ed54d4f89a313cf4a76ff0b070b39aa17
-