2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe
Size

1.3MB
MD5

2463370c86f1cedd245624df72a267f5
SHA1

52a34abaa2f9b4c911dcc1b1afa2995d75d68850
SHA256

2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96
SHA512

e4b888d778f19de541caced4cdb5f088075d9d0b9a2d44f4cae68821f9c2e0a2d2b1618b724087543345962bf06f64d5ec4f72139dd678dc90c7c95637ac72da
SSDEEP

12288:S0/dP4yWOmaHOk30CbQqO8ThGkQai+5sy4kB/c:S8wk739skQai+G7oc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe

pid process

1376 2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe

description pid process

Token: SeDebugPrivilege 1376 2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

944 DllHost.exe

pid	process
1376	2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe

description	pid	process
Token: SeDebugPrivilege	1376	2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe

pid	process
944	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe
"C:\Users\Admin\AppData\Local\Temp\2646ac7973155929d4a5a0006b32d54efa082fa604c8efc6809ca23b57f59e96.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.png

Filesize
248KB

MD5
f94f56073a6220f01c49b1de27dd0165

SHA1
7eee66fba8a4f38c6601f0f556f0a5c47cb610ad

SHA256
a4aeb018961baa811ee81448b6533f3f9d93ae7726c3d5037e06a242b00ec9a9

SHA512
ca495e26b7cc01d1e7751c2196fa7f2ae9b9437da79e0b0d560fd9310072d3d24514f081cd4da2ca7f392f8130b15e846651740d5053c33777d1382be37fa12b

Download Submit
memory/1376-54-0x0000000000020000-0x000000000017C000-memory.dmp

Filesize
1.4MB

Download
memory/1376-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads