e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd

Analysis

max time kernel
10s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe
Size

1.4MB
MD5

a36ad8ddcea662856c0262c8e809cd7a
SHA1

dca390a3fcab0344227690c70f2b1c94d843bf7d
SHA256

e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd
SHA512

504f2cff6a6ccdba87e032b6ded9c7e2cda2bf2078b61877eb6d5d4270125afb2a2713ab2f8cee7741a5c3275fb03a9146fe9d5bffe1b2b0513318f7c851b7b1
SSDEEP

24576:AXmV92cMiAKkezFGW+T1+eOCpKQzbb3bxEwk7uze:L2cM0eOCpKQzbb3ltze

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe

pid process

1020 e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe

description pid process

Token: SeDebugPrivilege 1020 e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

808 DllHost.exe

pid	process
1020	e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe

description	pid	process
Token: SeDebugPrivilege	1020	e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe

pid	process
808	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe
"C:\Users\Admin\AppData\Local\Temp\e7f5ab3a7e3fb271dc280d9876578969833b93d688050921ae4238d8d91211fd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.png

Filesize
248KB

MD5
f94f56073a6220f01c49b1de27dd0165

SHA1
7eee66fba8a4f38c6601f0f556f0a5c47cb610ad

SHA256
a4aeb018961baa811ee81448b6533f3f9d93ae7726c3d5037e06a242b00ec9a9

SHA512
ca495e26b7cc01d1e7751c2196fa7f2ae9b9437da79e0b0d560fd9310072d3d24514f081cd4da2ca7f392f8130b15e846651740d5053c33777d1382be37fa12b

Download Submit
memory/1020-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1020-56-0x0000000074460000-0x0000000074A0B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads