b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc

Analysis

max time kernel
72s
max time network
87s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe
Size

510KB
MD5

730c6813af9d7c692f9795a517eefd35
SHA1

c6bf79d06e6ede0025c8dff090e9f2bc0e58926c
SHA256

b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc
SHA512

0fef7f86803ba3ed251c390372b4c1773c3f2918863a28c181ffa961c37beaafc99c9790b21b0ddf277b79fc5ec4b53be08f3a745099296a79527f6e5307d4b8
SSDEEP

6144:M/uTVIGrZa2N2O5NHuComSO75/NEBcWtKyAkVHCc55aHQ1BDvO/WwZzuTSX/bCop:P6AgBM8JBDvcWwZzhiN

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

PersistanceModule.exe

pid process

972 PersistanceModule.exe
Loads dropped DLL 1 IoCs

Processes:

b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe

pid process

1992 b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exePersistanceModule.exe

pid process

1992 b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe
972 PersistanceModule.exe
972 PersistanceModule.exe

pid	process
972	PersistanceModule.exe

pid	process
1992	b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe

pid	process
1992	b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe
972	PersistanceModule.exe
972	PersistanceModule.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exePersistanceModule.exe

description	pid	process
Token: SeDebugPrivilege	1992	b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe
Token: SeDebugPrivilege	972	PersistanceModule.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe

description	pid	process	target process
PID 1992 wrote to memory of 972	1992	b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe	PersistanceModule.exe
PID 1992 wrote to memory of 972	1992	b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe	PersistanceModule.exe
PID 1992 wrote to memory of 972	1992	b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe	PersistanceModule.exe
PID 1992 wrote to memory of 972	1992	b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe	PersistanceModule.exe

C:\Users\Admin\AppData\Local\Temp\b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe
"C:\Users\Admin\AppData\Local\Temp\b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\Music\PersistanceModule.exe
"C:\Users\Admin\Music\PersistanceModule.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Music\PersistanceModule.exe
Filesize
510KB

MD5
730c6813af9d7c692f9795a517eefd35

SHA1
c6bf79d06e6ede0025c8dff090e9f2bc0e58926c

SHA256
b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc

SHA512
0fef7f86803ba3ed251c390372b4c1773c3f2918863a28c181ffa961c37beaafc99c9790b21b0ddf277b79fc5ec4b53be08f3a745099296a79527f6e5307d4b8

Download Submit
C:\Users\Admin\Music\PersistanceModule.exe
Filesize
510KB

MD5
730c6813af9d7c692f9795a517eefd35

SHA1
c6bf79d06e6ede0025c8dff090e9f2bc0e58926c

SHA256
b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc

SHA512
0fef7f86803ba3ed251c390372b4c1773c3f2918863a28c181ffa961c37beaafc99c9790b21b0ddf277b79fc5ec4b53be08f3a745099296a79527f6e5307d4b8

Download Submit
\Users\Admin\Music\PersistanceModule.exe
Filesize
510KB

MD5
730c6813af9d7c692f9795a517eefd35

SHA1
c6bf79d06e6ede0025c8dff090e9f2bc0e58926c

SHA256
b9e42eda591fdc5e0b64ffef74154535fdf7b486aedf7fd95d54f8bd3de02fbc

SHA512
0fef7f86803ba3ed251c390372b4c1773c3f2918863a28c181ffa961c37beaafc99c9790b21b0ddf277b79fc5ec4b53be08f3a745099296a79527f6e5307d4b8

Download Submit
memory/972-57-0x0000000000000000-mapping.dmp

Download
memory/972-61-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/972-63-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1992-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1992-62-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download