89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b

Analysis

max time kernel
107s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
Size

5.2MB
MD5

7c40ff927f112e3869581c044ba8f3cb
SHA1

7f8b11404e91ff5ae2d0b37afac8e48d4240d2ef
SHA256

89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b
SHA512

6a87fa9c6217d23a5deabb21f8caaa367cfd53fae951d937aae231af6a35218cc587252698922784351ea54e1663e7a72b41b04b5a16680ce482a417de559cf7
SSDEEP

98304:lw6WNM01LtmOTZje8tNJj669cERHEkN+nCF2oxuOv8QMyrYoQvMf60:lw6We01tmOT88tUdkSCF2oAs8QM4Q0fJ

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\V:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\Y:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\E:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\H:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\J:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\O:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\T:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\Z:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\B:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\F:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\I:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\L:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\M:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\S:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\U:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\A:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\N:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\P:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\Q:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\R:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\W:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\X:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
File opened (read-only)	\??\K:	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1388	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
Token: SeDebugPrivilege	1388	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1388	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
1388	89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe

C:\Users\Admin\AppData\Local\Temp\89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe
"C:\Users\Admin\AppData\Local\Temp\89bd4e84248c0375de8b87ab7f237e95b8c3eeb6310cc99682b66133cdd4690b.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/1388-57-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/1388-58-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download