abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea

Analysis

max time kernel
176s
max time network
205s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe
Size

312KB
MD5

80320f6185dd9347b88ccebf1c8897f6
SHA1

e2222b155067e002d31c82be0403b36ed453537f
SHA256

abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea
SHA512

426a7f93bf1ed0ecb7ae8f28f466c06be7c594bcb15118412d55b152a9d2530d2ef6205f2ae9c003f2685cb6e2e1b31dd5f75bf3f1fd597522ecc5a8bcad2c17
SSDEEP

3072:jk6y38qiVy3aWuwpeTgYuAXHs+3xr9hvqBuMnwqCYf6I3HutHKc0Sps96pMFVzDp:jxg8qdPnsXM+3x9CwqCYfDO/W9bpHGYd

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

pid	process
1208	abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe
1208	abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

description pid process

Token: SeDebugPrivilege 1208 abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

description	pid	process
Token: SeDebugPrivilege	1208	abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

pid	process
1208	abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe
1208	abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe

C:\Users\Admin\AppData\Local\Temp\abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe
"C:\Users\Admin\AppData\Local\Temp\abe82bf4c8975f688664e84bc16de4325e72dc5e8a2c700643da4f6ef6b9a9ea.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bhsF77A.tmp

Filesize
241KB

MD5
4019c3f4733fc5887b969239140c67dd

SHA1
e57bf75f8b7e361a11009c6112518972f82440fe

SHA256
cafe6f185347c30bd74a1fd8e774471ef1c5886369b13db44b923a905c8b9006

SHA512
74aabeeaf4d7304b64b7fe6642138663b0ff4e63a6bce57f8d23fba578e869af09fa94eb672e5176f1bcbb32b5ea95751f9dd201f83f773f8f368cbb8e087375

Download Submit
\Users\Admin\AppData\Local\Temp\bhsF77A.tmp

Filesize
241KB

MD5
4019c3f4733fc5887b969239140c67dd

SHA1
e57bf75f8b7e361a11009c6112518972f82440fe

SHA256
cafe6f185347c30bd74a1fd8e774471ef1c5886369b13db44b923a905c8b9006

SHA512
74aabeeaf4d7304b64b7fe6642138663b0ff4e63a6bce57f8d23fba578e869af09fa94eb672e5176f1bcbb32b5ea95751f9dd201f83f773f8f368cbb8e087375

Download Submit
memory/1208-56-0x0000000000440000-0x0000000000482000-memory.dmp

Filesize
264KB

Download
memory/1208-57-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1208-58-0x00000000046A7000-0x00000000046B8000-memory.dmp

Filesize
68KB

Download
memory/1208-59-0x000000000C9D0000-0x000000000D176000-memory.dmp

Filesize
7.6MB

Download
memory/1208-60-0x00000000046A7000-0x00000000046B8000-memory.dmp

Filesize
68KB

Download