b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe

Analysis

max time kernel
146s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:48

Target

b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe
Size

2.8MB
MD5

2aa4088717b62dab52cfb867e2b2bc3f
SHA1

e0db44088e21f67c266ac3782f9507cdeb4d1e58
SHA256

b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe
SHA512

799266fc9856175804a7c7b94206d77babfc82d5796cfd526b7d9464c539e0a838bd64a26e1730ee9d0ac6528aed7f98f291dc7a394cb0dd8db9a3d397450f72
SSDEEP

49152:dQK54yqINtkLBDHGyJZOoW12NprDVP0Osa3NB9bgT37MW5dUlgaw:dN5LqINmNzGyJZmwNprDRya3NH8nulk

Score

8^/10

Drops file in Drivers directory 1 IoCs

Processes:

b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

pid process

1192 b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

description pid process

Token: SeDebugPrivilege 1192 b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

description	pid	process
Token: SeDebugPrivilege	1192	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

pid	process
1192	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe
1192	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe

description	pid	process	target process
PID 1192 wrote to memory of 1548	1192	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe	cmd.exe
PID 1192 wrote to memory of 1548	1192	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe	cmd.exe
PID 1192 wrote to memory of 1548	1192	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe	cmd.exe
PID 1192 wrote to memory of 1548	1192	b2ab983ec8f26741677e95ba3f26c413288a865f8cc00e3a61067e8a42fb79fe.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etckkZef" /S /Q
2⤵
PID:1548

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1192-60-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-55-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-57-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-56-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-58-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-59-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-54-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download
memory/1192-61-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-62-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-63-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-65-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1192-66-0x0000000000400000-0x00000000007C8000-memory.dmp

Filesize
3.8MB

Download
memory/1548-64-0x0000000000000000-mapping.dmp

Download