Overview

overview

3

Static

static

7e759779bb...3b.exe

windows7-x64

3

7e759779bb...3b.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    158s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 04:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7e759779bb47f12958558a5cb2d05751dfe4c0c7dea6e3eaf839e4fc5348923b.exe

  • Size

    1.3MB

  • MD5

    706e40ead377774eb7ec5b9ae1155aaa

  • SHA1

    88ef2f4d6d09429eecc8f680282b3ce43a79f929

  • SHA256

    7e759779bb47f12958558a5cb2d05751dfe4c0c7dea6e3eaf839e4fc5348923b

  • SHA512

    b14f8c8a3fd75af7a8eefbbab99e9879f05414b7bd85b2600b72674712c67cd5da83c0eda1b2aa0fa1feb70ff775f0af4751df9d853a7ab0c6b1b1a5ecacb0d5

  • SSDEEP

    12288:S0/dP4yWOmaHOk30CbQqO8ThGkQai+5sy4kB/8:S8wk739skQai+G7o8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e759779bb47f12958558a5cb2d05751dfe4c0c7dea6e3eaf839e4fc5348923b.exe
    "C:\Users\Admin\AppData\Local\Temp\7e759779bb47f12958558a5cb2d05751dfe4c0c7dea6e3eaf839e4fc5348923b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3352

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3352-132-0x0000000000F50000-0x00000000010AC000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/3352-133-0x0000000005930000-0x00000000059C2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3352-134-0x0000000006000000-0x00000000065A4000-memory.dmp
    Filesize

    5.6MB

    Download