Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
25-11-2022 12:42
General
-
Target
a88c815fae850af8a225c66ba975baa135a6acb92d38be54ecd6f32eca4798a8.exe
-
Size
476KB
-
MD5
aeaa9128afa36151520e1b335f89b2a3
-
SHA1
8c164195693b962aee2f760072ddf021e15dd132
-
SHA256
a88c815fae850af8a225c66ba975baa135a6acb92d38be54ecd6f32eca4798a8
-
SHA512
f3c50c6474f08fee81ad8658e46631572e34c3c688db24388772953c46c12783cad14e39ed08f494dd8f77e6def790d80c658b6ea8d299a2a58b48a2abc9600d
-
SSDEEP
12288:bfUzuKk/o4GIzKxrbdbML5xsbkJtznLBe0M60HxHpAS:bfOmo4ilbdb420TLpMJV
Score
8/10
Malware Config
Signatures
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a88c815fae850af8a225c66ba975baa135a6acb92d38be54ecd6f32eca4798a8.exe"C:\Users\Admin\AppData\Local\Temp\a88c815fae850af8a225c66ba975baa135a6acb92d38be54ecd6f32eca4798a8.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5141⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1508-55-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1508-56-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1508-57-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-60-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-59-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-61-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-62-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-64-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-66-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-68-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-70-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-72-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-74-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-80-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-78-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-82-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-86-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-90-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-94-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-100-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-102-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-98-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-96-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-92-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-88-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-84-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-76-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB
-
memory/1508-103-0x0000000010000000-0x000000001003D000-memory.dmpFilesize
244KB