01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f

Analysis

max time kernel
69s
max time network
60s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe
Size

2.6MB
MD5

c6cc0a3b77e3bd43c977ffae1eb7520e
SHA1

aa6b8853a7ceb1bac762f22131917b4d5ee89142
SHA256

01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f
SHA512

1b18d939817330d36c1834f06d84d6fac211ea41c4e4a33d0acececfb56cd52c74fa6511031af1820379ed47e8ed5f3b4ced34973096e525341841ed2726fc97
SSDEEP

49152:UJuEzDp0nzSv8EG1k3DFCZasY6DwOBfrnvV7UeWt95Z:UkEz90zyK1k3DFIYiwOBpIeWzj

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1492	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

Loads dropped DLL 1 IoCs

pid	Process
1824	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1492	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1492	1824	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe	28
PID 1824 wrote to memory of 1492	1824	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe	28
PID 1824 wrote to memory of 1492	1824	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe	28
PID 1824 wrote to memory of 1492	1824	01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe	28

C:\Users\Admin\AppData\Local\Temp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe
"C:\Users\Admin\AppData\Local\Temp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\cosqlzb4.ypp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe
  "C:\Users\Admin\AppData\Local\Temp\cosqlzb4.ypp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cosqlzb4.ypp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

Filesize
2.2MB

MD5
9d42a9eaee78d72a0839150de886e922

SHA1
86181349fb5cf8406711c4dc36af9079af1033f2

SHA256
6c9c5053da6a9e80c7afe18b9436615e88dc83da972d8f893c3b117dd5c471fb

SHA512
0f28a36033a7b68737fe03fedaa01184739ee76a0866ad25457fe873edd5e9d8d2d960485273c556bfd6ee7a91620b0217b07bfd1a2f14c822622492da73e7e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cosqlzb4.ypp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

Filesize
2.2MB

MD5
9d42a9eaee78d72a0839150de886e922

SHA1
86181349fb5cf8406711c4dc36af9079af1033f2

SHA256
6c9c5053da6a9e80c7afe18b9436615e88dc83da972d8f893c3b117dd5c471fb

SHA512
0f28a36033a7b68737fe03fedaa01184739ee76a0866ad25457fe873edd5e9d8d2d960485273c556bfd6ee7a91620b0217b07bfd1a2f14c822622492da73e7e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cosqlzb4.ypp\icon

Filesize
136KB

MD5
77065ce9dd4b539fd4089a2a20cda46a

SHA1
18b39de47e4d7bb2e80c9315762b61998aecf75d

SHA256
1210adab883503cc8670e0725aea3e6105c70d555c50dcc3385895c6a856852f

SHA512
9b5417122da042f75f1b7d43da12c8a253e634c2356ec0efb90cde344b8fdba4c03b16c6eb04a166b47c6c78f43d358145683ee538caec939cf6550e1a4c4e09

Download Submit
\Users\Admin\AppData\Local\Temp\cosqlzb4.ypp\01c7b40050d4803a2808ad181b702a8b1f8844b702b3728195fb77d8c903d66f.exe

Filesize
2.2MB

MD5
9d42a9eaee78d72a0839150de886e922

SHA1
86181349fb5cf8406711c4dc36af9079af1033f2

SHA256
6c9c5053da6a9e80c7afe18b9436615e88dc83da972d8f893c3b117dd5c471fb

SHA512
0f28a36033a7b68737fe03fedaa01184739ee76a0866ad25457fe873edd5e9d8d2d960485273c556bfd6ee7a91620b0217b07bfd1a2f14c822622492da73e7e9

Download Submit
memory/1492-62-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1492-64-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1824-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1824-55-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1824-61-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download