Overview

overview

3

Static

static

2ebd61868b...35.exe

windows7-x64

3

2ebd61868b...35.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    182s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 06:46 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2ebd61868b9f11c4804daaea0c3c7cb193d590ea25bd5a828a981cd5031e0235.exe

  • Size

    3KB

  • MD5

    1ec0a03a0397d6e478662e0c204e6790

  • SHA1

    7d27d91843b85c28c7c20f4f8e76885e0e9485bb

  • SHA256

    2ebd61868b9f11c4804daaea0c3c7cb193d590ea25bd5a828a981cd5031e0235

  • SHA512

    1703cd70f4c7744bbc5a42725b578acc9cc0403c3fe11087cfbd2985800dcc70af8cfa5079caad5021ceda5a6e63c4a29a0a58028a9cde1c4ad057729c18fce0

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ebd61868b9f11c4804daaea0c3c7cb193d590ea25bd5a828a981cd5031e0235.exe
    "C:\Users\Admin\AppData\Local\Temp\2ebd61868b9f11c4804daaea0c3c7cb193d590ea25bd5a828a981cd5031e0235.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:372

Network

  • flag-unknown
    DNS
    97.97.242.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.97.242.52.in-addr.arpa
    IN PTR
    Response
  • flag-unknown
    DNS
    14.110.152.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.110.152.52.in-addr.arpa
    IN PTR
    Response
  • flag-unknown
    DNS
    0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • 8.253.208.121:80
    322 B
     7
  • 20.190.159.64:443
    260 B
     5
  • 8.238.20.126:80
    322 B
     7
  • 104.80.225.205:443
    322 B
     7
  • 52.152.108.96:443
    260 B
     5
  • 8.8.8.8:53
    97.97.242.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.97.242.52.in-addr.arpa

  • 8.8.8.8:53
    14.110.152.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    14.110.152.52.in-addr.arpa

  • 8.8.8.8:53
    0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
     204 B
     1
    1

    DNS Request

    0.e.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/372-132-0x00007FFA947A0000-0x00007FFA951D6000-memory.dmp

    Filesize

    10.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.