75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe
Size

1.3MB
MD5

17ed41a75f0dae4963ed3638260dfca7
SHA1

2306fd5d79a8c2c99b99ff658c9137c0f949e73e
SHA256

75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad
SHA512

8227ead98474e8aff1022b24147968d34558ed920026b987af580addd3e66604b7cd19555d16a7e2cb5c73259721829299f2a3d7c9438ab93b3d7b7cb0d57298
SSDEEP

12288:S0/dP4yWOmaHOk30CbQqO8ThGkQai+5sy4kB/S:S8wk739skQai+G7oS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe

pid process

1980 75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe

description pid process

Token: SeDebugPrivilege 1980 75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1396 DllHost.exe

pid	process
1980	75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe

description	pid	process
Token: SeDebugPrivilege	1980	75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe

pid	process
1396	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe
"C:\Users\Admin\AppData\Local\Temp\75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.png

Filesize
248KB

MD5
f94f56073a6220f01c49b1de27dd0165

SHA1
7eee66fba8a4f38c6601f0f556f0a5c47cb610ad

SHA256
a4aeb018961baa811ee81448b6533f3f9d93ae7726c3d5037e06a242b00ec9a9

SHA512
ca495e26b7cc01d1e7751c2196fa7f2ae9b9437da79e0b0d560fd9310072d3d24514f081cd4da2ca7f392f8130b15e846651740d5053c33777d1382be37fa12b

Download Submit
memory/1980-54-0x0000000000150000-0x00000000002AC000-memory.dmp

Filesize
1.4MB

Download
memory/1980-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads