26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe
Size

1.3MB
MD5

e33ee7f396945884e2647d1e039605a5
SHA1

73b8e72b1b6eb7f63de5918ee4a6994bd60b6d57
SHA256

26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077
SHA512

b48ee4ebbc3ce514913caec218edc93fefcd454fa86b9b18f820b6e1f1512d275dccf89f9998f8e2a1969843db8d6b4e6d06088e15c8d8aec1297b5d79b8c98f
SSDEEP

12288:S0/dP4yWOmaHOk30CbQqO8ThGkQai+5sy4kB/e:S8wk739skQai+G7oe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe

pid process

936 26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe

description pid process

Token: SeDebugPrivilege 936 26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1464 DllHost.exe

pid	process
936	26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe

description	pid	process
Token: SeDebugPrivilege	936	26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe

pid	process
1464	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe
"C:\Users\Admin\AppData\Local\Temp\26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.png

Filesize
248KB

MD5
f94f56073a6220f01c49b1de27dd0165

SHA1
7eee66fba8a4f38c6601f0f556f0a5c47cb610ad

SHA256
a4aeb018961baa811ee81448b6533f3f9d93ae7726c3d5037e06a242b00ec9a9

SHA512
ca495e26b7cc01d1e7751c2196fa7f2ae9b9437da79e0b0d560fd9310072d3d24514f081cd4da2ca7f392f8130b15e846651740d5053c33777d1382be37fa12b

Download Submit
memory/936-54-0x0000000000960000-0x0000000000ABC000-memory.dmp

Filesize
1.4MB

Download
memory/936-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads