Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:17
Static task
static1
Behavioral task
behavioral1
Sample
efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe
Resource
win10v2004-20220812-en
General
-
Target
efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe
-
Size
20KB
-
MD5
43f060864e8357dfb5119efdfff65bb0
-
SHA1
7343a3b7e6cd0bb1e745ea5906cc08408c5a5926
-
SHA256
efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81
-
SHA512
c5b56c232ed9ef0c0b5782e32045c7f750f0cd32ee993b7c83774141d2a93dc2e9255d47834bdcc87681d6f1bb23964d784f83ab70787222c5e1b1ef866b1580
-
SSDEEP
384:GAdiizfZsDiM3PfsBhnRGjLbjnsJzmfmOAPaz1:GAd3f41ETKfm/PaR
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 616 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tasklist.exedescription pid process Token: SeDebugPrivilege 1636 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exepid process 1220 efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.execmd.exedescription pid process target process PID 1220 wrote to memory of 616 1220 efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe cmd.exe PID 1220 wrote to memory of 616 1220 efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe cmd.exe PID 1220 wrote to memory of 616 1220 efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe cmd.exe PID 1220 wrote to memory of 616 1220 efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe cmd.exe PID 616 wrote to memory of 1636 616 cmd.exe tasklist.exe PID 616 wrote to memory of 1636 616 cmd.exe tasklist.exe PID 616 wrote to memory of 1636 616 cmd.exe tasklist.exe PID 616 wrote to memory of 1636 616 cmd.exe tasklist.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe"C:\Users\Admin\AppData\Local\Temp\efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del efeffd6ecf186cc3b6d9b8687eadbd581f3e9fbffd447a0f4a02a07931698c81.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1636