f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20

Analysis

max time kernel
44s
max time network
203s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe
Size

676KB
MD5

f9ecf4262d32443f64cac91f0a399880
SHA1

67edffccf2b360bc7c9f2d6c2ee2dd7cc692d580
SHA256

f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20
SHA512

3b8fb2030b00212b52130690ed8465d272601ec88c47ac8b4c494d7c5185ee92f147299b96519b79031d0eb8baa7cc214ac0a3dc1a2f4caab2d2f390f5069522
SSDEEP

6144:yPWtCEea9jZm5uowvLLgbYPslX3uYoOXrqPCd/hqq6JIVOBBmLHyYu317:yOtfeZNwvLMs015oO7qKd/SJ9m9u317

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe

pid process

936 f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe

description pid process

Token: SeDebugPrivilege 936 f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1104 DllHost.exe

pid	process
936	f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe

description	pid	process
Token: SeDebugPrivilege	936	f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe

pid	process
1104	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe
"C:\Users\Admin\AppData\Local\Temp\f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f370d2604eb58a01f90074978f272f4dbfc1f313f24efc39494be209815e7d20.png

Filesize
100KB

MD5
1459e316ff547922e7c0c90074c5991f

SHA1
9ec25941fd33cc320e7aadf8922045e47e3246f8

SHA256
4b2fa39e99aa1f2c71788974417155f4588f17557c9070f2e441b212b432bb0f

SHA512
4e1487f25adcf848a4f5d87080d02925961dbab7848f4be55e2ce365074f2c40785b535f60797fe7970a919c90a5749f32d10668112e76a5be42f9c881384ccc

Download Submit
memory/936-54-0x0000000001100000-0x00000000011B0000-memory.dmp

Filesize
704KB

Download
memory/936-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/936-56-0x00000000003D0000-0x00000000003EE000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads