Analysis
-
max time kernel
294s -
max time network
332s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01/12/2022, 23:01
General
-
Target
5745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151.exe
-
Size
465KB
-
MD5
dd3543ab8ebc670d9a2dd54e15b4f48e
-
SHA1
7b76a1b51cf5495beeada377ef0221a977988dca
-
SHA256
5745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151
-
SHA512
f95cdb807991cf61bfca5fcca17a3c123cb5939cb1481a568a9119fb9bed764a15b5ddf2478f41ee5c2b35aea57f48e0363993157640c02b4720c36c63606679
-
SSDEEP
12288:06WJxSJSP2qIbjPTOc5/W1hn9YjvD8xY+:06WJwSYjPTO6a9kh+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151.exe"C:\Users\Admin\AppData\Local\Temp\5745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5BE8202E-442C-40AF-BCD7-67B56656E0A6} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\5745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151.exeC:\Users\Admin\AppData\Roaming\5745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
465KB
MD5dd3543ab8ebc670d9a2dd54e15b4f48e
SHA17b76a1b51cf5495beeada377ef0221a977988dca
SHA2565745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151
SHA512f95cdb807991cf61bfca5fcca17a3c123cb5939cb1481a568a9119fb9bed764a15b5ddf2478f41ee5c2b35aea57f48e0363993157640c02b4720c36c63606679
-
Filesize
465KB
MD5dd3543ab8ebc670d9a2dd54e15b4f48e
SHA17b76a1b51cf5495beeada377ef0221a977988dca
SHA2565745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151
SHA512f95cdb807991cf61bfca5fcca17a3c123cb5939cb1481a568a9119fb9bed764a15b5ddf2478f41ee5c2b35aea57f48e0363993157640c02b4720c36c63606679
-
Filesize
465KB
MD5dd3543ab8ebc670d9a2dd54e15b4f48e
SHA17b76a1b51cf5495beeada377ef0221a977988dca
SHA2565745e6498f2e66aa784578ba5e8b606ba69d49000dbc0550c9df3cc59ef8f151
SHA512f95cdb807991cf61bfca5fcca17a3c123cb5939cb1481a568a9119fb9bed764a15b5ddf2478f41ee5c2b35aea57f48e0363993157640c02b4720c36c63606679
-
Filesize
640KB
-
Filesize
344KB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
8KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
124KB
-
Filesize
88KB
-
Filesize
3.0MB
-
Filesize
11.4MB
-
Filesize
12KB
-
Filesize
10.1MB
-
Filesize
124KB
-
Filesize
12KB
-
Filesize
124KB