Analysis
-
max time kernel
237s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
28/11/2022, 02:25
General
-
Target
cd7f427376871b6dbe57cd60561c2814263f9e7591fd0485266aa2d4e780a8a9.exe
-
Size
128KB
-
MD5
4b047c44aaffd08a700f8efe81e47d2d
-
SHA1
33c3be1fa551189a5be91f34f62fc2e024e4ea3b
-
SHA256
cd7f427376871b6dbe57cd60561c2814263f9e7591fd0485266aa2d4e780a8a9
-
SHA512
3efa216ff0db94085602bde46921e048d34c1e98479e3f594d4ed31b6f6b18036e146099cc5a0ecf0bf645c6344e7fe00634e1f91f44cbd18693ced1781207c7
-
SSDEEP
3072:7R6byFZm8mgHxLD6bJLVRs1OTUnDwaH5Ik:96uDmVgHx/QVVpUnDwaHS
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd7f427376871b6dbe57cd60561c2814263f9e7591fd0485266aa2d4e780a8a9.exe"C:\Users\Admin\AppData\Local\Temp\cd7f427376871b6dbe57cd60561c2814263f9e7591fd0485266aa2d4e780a8a9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5599b2b9b54023a96861b40116e072230
SHA1f2f7f88d344e7aeaf546b7a5ef660b04bb6a731f
SHA256c7fdbcbbe436dfefefecc6ce81ab8be3173d77aa9f836072440b35877ec7972d
SHA512af52188c342a16c29fe9d4656786105c11fe194779faadcd69f9c6fc259588ec5e58e9d635f6e6896f444d0a0e5e4e5e96f5a53024a8bb806cf1f52090e9af61
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
