Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 11:05
General
-
Target
2358035b1b261f8a20d2aaf319805dd339a73c9937eaa7b1e97c626e016dc57e.exe
-
Size
5.6MB
-
MD5
601c231b9179e8a26c32b7ea768ff9fa
-
SHA1
bf0e234e6044e67f82604bf4eea31772bb9aaa7f
-
SHA256
2358035b1b261f8a20d2aaf319805dd339a73c9937eaa7b1e97c626e016dc57e
-
SHA512
a6b64763130e54b1eab160647a61aef729cdb841bd864b2239363bf25e10c2b510dee6c086900c2bb5ed47122b8de692e21a83872cbea850930aa3661feb8c24
-
SSDEEP
98304:6VH613QPlfOnNhfJkRyTrpcTcCGQD/7vwGAB8HDA6azXCcA0kotVx5Qsasq3:saRUlfONh2Ec3nEEKCcvkK5QsasG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2358035b1b261f8a20d2aaf319805dd339a73c9937eaa7b1e97c626e016dc57e.exe"C:\Users\Admin\AppData\Local\Temp\2358035b1b261f8a20d2aaf319805dd339a73c9937eaa7b1e97c626e016dc57e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-50R0T.tmp\2358035b1b261f8a20d2aaf319805dd339a73c9937eaa7b1e97c626e016dc57e.tmp"C:\Users\Admin\AppData\Local\Temp\is-50R0T.tmp\2358035b1b261f8a20d2aaf319805dd339a73c9937eaa7b1e97c626e016dc57e.tmp" /SL5="$8004A,5604491,56832,C:\Users\Admin\AppData\Local\Temp\2358035b1b261f8a20d2aaf319805dd339a73c9937eaa7b1e97c626e016dc57e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
690KB
MD51305181de520f125aeabf85dc24a89d6
SHA198b7548fede3f1468ccbdee405abdc4e5d2ec671
SHA2560e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf
SHA512b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793
-
Filesize
690KB
MD51305181de520f125aeabf85dc24a89d6
SHA198b7548fede3f1468ccbdee405abdc4e5d2ec671
SHA2560e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf
SHA512b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
381KB
MD586793901ef19641dc1b53b493927a2b7
SHA1720c5be19158d8295f54a5dfad7a59783da20e91
SHA256cc76361d01e50138c7cd420e11f41392b62dc0161ffbcc029df086b354cae7b6
SHA5121771d99bc49fad3121cc1aed8287e636dafdd754432087532bccbff664ca75cdaecbe3b217c084923e4084d73dc9e060d8436d98c2a6e50f00b04c2127b47286
-
Filesize
381KB
MD586793901ef19641dc1b53b493927a2b7
SHA1720c5be19158d8295f54a5dfad7a59783da20e91
SHA256cc76361d01e50138c7cd420e11f41392b62dc0161ffbcc029df086b354cae7b6
SHA5121771d99bc49fad3121cc1aed8287e636dafdd754432087532bccbff664ca75cdaecbe3b217c084923e4084d73dc9e060d8436d98c2a6e50f00b04c2127b47286
-
Filesize
356KB
MD57ada33a1f5e958c97dab09fc14ad0c86
SHA15b6066f1645788765351bb3eb96517ace2b01040
SHA2567bf04e7acd79050460d37443a0eb00592fe3f6f43a4209a717637d574bd994c0
SHA512ec8440bb91feb1516409212f94ad862e785178fc3fbe88ecb822d19bc7460edcb521e77fe2d75d67ef4ac7edd3c8f3275664bae15ae61161b343b3b0c60ac024
-
Filesize
84KB
-
Filesize
412KB
-
-
Filesize
1.3MB
-
Filesize
80KB
-
Filesize
80KB