737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f

Analysis

max time kernel
71s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:01

Target

737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe
Size

24KB
MD5

50a5d4c0cc7acf35a03813d379811198
SHA1

2dd2b9f047ebc2c439da3582b8494551c2380b15
SHA256

737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f
SHA512

b4ab7822e148a3fbc4f1881548ae3171d2722fe791e427e7ddff1df3f226908bc6e212fc764c3eaddaf6585fc27304476a130472b143372309eab563918dd668
SSDEEP

384:eNu10YN7b46+zU43BtgiiHEMBtuTn7O4hZEbxw:KuGp6SNiJmBzEm

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

544 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

988 tasklist.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tasklist.exe

description pid process

Token: SeDebugPrivilege 988 tasklist.exe

pid	process
544	cmd.exe

pid	process
988	tasklist.exe

description	pid	process
Token: SeDebugPrivilege	988	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe

pid	process
1600	737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe
1600	737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.execmd.exe

description	pid	process	target process
PID 1600 wrote to memory of 544	1600	737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe	cmd.exe
PID 1600 wrote to memory of 544	1600	737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe	cmd.exe
PID 1600 wrote to memory of 544	1600	737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe	cmd.exe
PID 1600 wrote to memory of 544	1600	737eabffd71f5dc1e58ad42f33fafb863190827de054a135d267507c7501255f.exe	cmd.exe
PID 544 wrote to memory of 988	544	cmd.exe	tasklist.exe
PID 544 wrote to memory of 988	544	cmd.exe	tasklist.exe
PID 544 wrote to memory of 988	544	cmd.exe	tasklist.exe
PID 544 wrote to memory of 988	544	cmd.exe	tasklist.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/544-58-0x0000000000000000-mapping.dmp

Download
memory/988-59-0x0000000000000000-mapping.dmp

Download
memory/1600-57-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download