Analysis
-
max time kernel
48s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26/11/2022, 23:17
General
-
Target
1223b6511da56ee3950217d3b63ade252974b15b89f2e80ef9dcdfe9d9008dc5.exe
-
Size
745KB
-
MD5
360ea1024e2e3a415909be64d4b77145
-
SHA1
9b5d264ccc1498040745ab75398fc56750b29212
-
SHA256
1223b6511da56ee3950217d3b63ade252974b15b89f2e80ef9dcdfe9d9008dc5
-
SHA512
211bdcf87e9887018f9ea5c5f4b1b013c4aadb63bc7c49e979c49dee0389d859d7de0d608e489b49559fc53bf8593c0f8504e46f14ebc441ce1ac6f860f24f10
-
SSDEEP
12288:pYqJR+JtCvIO7rNEOAKTDT8wl+Kj98mzFa5QFLkaKWyw2xKqzRduuE:eqJhvd7r+OAwT8wlt9tFDEXwTqzRcd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1223b6511da56ee3950217d3b63ade252974b15b89f2e80ef9dcdfe9d9008dc5.exe"C:\Users\Admin\AppData\Local\Temp\1223b6511da56ee3950217d3b63ade252974b15b89f2e80ef9dcdfe9d9008dc5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD50a0823b1839c57d06191dcfcf10ce441
SHA122b8a65e7edc634c4ea933884390e1d9fc97712a
SHA2562446b7c267f7d63e02a61a3fcb45141580bc2dfac5816535a774dc29b1cf564a
SHA512f664076a549e95db7301520778311652f02967909d9abc391fe637c8de6a11ecc0ec49d3a1cd4cffc63364dcc186084d1657fcef711cb6d47b84ea536631b960
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
