471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8

Analysis

max time kernel
142s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 12:09

Target

471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe
Size

1.9MB
MD5

2917c9210d54f633dcfbe34a88a7cdbf
SHA1

0d4115ada5ca2085e28e6efe98ed4f51843b559d
SHA256

471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8
SHA512

847293a786557dd758de701d4b6821506c76858d6c415a0fee906079b39a362378caa31a932824220288dee1f2405088c321ca754a62e8ce154f66c5d2b0b85b
SSDEEP

49152:1mgK+ibT+L/Gzo1D5D2+wZLDGVAORvnhs9c8GxJsn:MgLibqL/GzO/kvG51i9HWJsn

Score

8^/10

Drops file in Drivers directory 1 IoCs

Processes:

471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

pid process

1368 471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

description pid process

Token: SeDebugPrivilege 1368 471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

description	pid	process
Token: SeDebugPrivilege	1368	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

pid	process
1368	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe
1368	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe

description	pid	process	target process
PID 1368 wrote to memory of 984	1368	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe	cmd.exe
PID 1368 wrote to memory of 984	1368	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe	cmd.exe
PID 1368 wrote to memory of 984	1368	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe	cmd.exe
PID 1368 wrote to memory of 984	1368	471de26a98e986f0608b37dc74941b05c4c43c6f6d4858266e1193b0df5093c8.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etclQRzE" /S /Q
2⤵
PID:984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/984-56-0x0000000000000000-mapping.dmp

Download
memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/1368-57-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download