e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9

Analysis

max time kernel
78s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe
Size

128KB
MD5

2f9f6a53c4123b7743496d4705f1f2df
SHA1

9d82079b9e1848b8df53105f15188ac958f55707
SHA256

e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9
SHA512

5ac08af27b3c85605f06218391325e74dfccd0c64159477aeb75b1f46e4fecd017d7c1f72a362201b59dabbf421bb22723884cbb4cce855b6d9655e169c6540e
SSDEEP

768:kDbM0G1aIeMT2eaxg83PuUeqTaeBBW+9BkhtLxzjroQTo2jzr/fDHLVQIAxQQ:knMDaacg8GtyTlML1VfjLHlAT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1068	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1724	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
868	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe
868	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1068	868	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe	29
PID 868 wrote to memory of 1068	868	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe	29
PID 868 wrote to memory of 1068	868	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe	29
PID 868 wrote to memory of 1068	868	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe	29
PID 1068 wrote to memory of 1724	1068	cmd.exe	31
PID 1068 wrote to memory of 1724	1068	cmd.exe	31
PID 1068 wrote to memory of 1724	1068	cmd.exe	31
PID 1068 wrote to memory of 1724	1068	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe
"C:\Users\Admin\AppData\Local\Temp\e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-57-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/868-58-0x0000000003D50000-0x000000000480A000-memory.dmp

Filesize
10.7MB

Download