2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2

Analysis

max time kernel
269s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
Size

3KB
MD5

4ff8f119ef8963e32ced2b87a23bc480
SHA1

33a360c8839ebfd0b026fcbd680704ac6d01a499
SHA256

2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2
SHA512

0ad3a1438f2319b10ed25643f03134040bdcc3dbcdfae0b836b65db26ea890ab6546bc6c03bc656a65739363031e5861722c64fa0eacc46367227a1126357159

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe

C:\Users\Admin\AppData\Local\Temp\2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe
"C:\Users\Admin\AppData\Local\Temp\2f001e8ad0133b2bb2dbd56318b825dc36e4d4c153bff0a6542aa4a63d778ec2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-54-0x000007FEF31B0000-0x000007FEF3BD3000-memory.dmp

Filesize
10.1MB

Download
memory/1740-55-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download