5c2e7e0f84c9c3220a5587bc2122278d79aca29f3e9750d45ba168caabbe4c8b

Analysis

max time kernel
306s
max time network
362s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:57

Target
5c2e7e0f84c9c3220a5587bc2122278d79aca29f3e9750d45ba168caabbe4c8b.exe
Size 599KB
Sample221128-dfry3aab76
SHA256 5c2e7e0f84c9c3220a5587bc2122278d79aca29f3e9750d45ba168caabbe4c8b
MD5 2b36074a435f3dd149843f014ee595e0
SHA1 16875ba6e1bf8d916d9c0668d2feb35518232973
SHA512 ca0370a5ca9f329ecf5aab1c196467c81884ff6245d4a906405e00be251be0a366cc986a7d8a7d4bec0872d9272e5d221434c5347a57e84fae9a99e64eaaef68
SSDEEP 12288:AMZfUBXb6qO2pCxy2Ge6DLM1k64f7gDerQkfFywQ1t:rsBLbO2gxymB264zgabFyw2t
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

evasion trojan

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5c2e7e0f84c9c3220a5587bc2122278d79aca29f3e9750d45ba168caabbe4c8b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\X2014	5c2e7e0f84c9c3220a5587bc2122278d79aca29f3e9750d45ba168caabbe4c8b.exe
File opened for modification	C:\Windows\r3t8\	5c2e7e0f84c9c3220a5587bc2122278d79aca29f3e9750d45ba168caabbe4c8b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact