8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d

Analysis

max time kernel
190s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
Size

120KB
MD5

cc382cb807d4b95e40e8cb5ac32aa9d8
SHA1

5cee8113fe9139b08c47d2ae38ef62bd1025ee12
SHA256

8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d
SHA512

6f26dd3ea2efb4f325c5e0efa468ffd5e77859ef2931a3a7323ebba4afb3df634d315398a617871681b4e60d126ee98e758f29e724c5b430c83a72ef041b25d2
SSDEEP

1536:HJoLNXL3Fq1eVgTFdbnVY6hTxlp3cdlT2ZGoF:Hmb9ALm6hNcdpWlF

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\T:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\B:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\H:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\O:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\P:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\R:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\M:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\N:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\U:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\A:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\E:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\F:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\J:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\L:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\Y:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\Z:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\I:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\K:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\V:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\W:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\X:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\G:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
File opened (read-only)	\??\Q:	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1544	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
Token: SeCreatePagefilePrivilege	1544	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe

C:\Users\Admin\AppData\Local\Temp\8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe
"C:\Users\Admin\AppData\Local\Temp\8a9a7249422a09277d4aedbaaaeb8d9ca29705713105be657de524840825280d.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-133-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1544-136-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download