aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed

Analysis

max time kernel
69s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe
Size

24KB
MD5

0b74ccd651767a10d37484be13b665e2
SHA1

c7d473fa845520c9f70b792ad90d2153cf3659ea
SHA256

aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed
SHA512

688d6c7a06aaa066cfb52146d8cc0550513c76cc78dad54976f69fb480fdecc715a68deef0077dd23d1d380a8be6d6be8b77baff18e972328ade6fd48106556b
SSDEEP

192:E214T+9dDh7Ulvkgp/verDz7AtJUMGO+0/cdtmP2kyjHo3TWjVja/qxw:999gvkI/v8DPAttlyjI3TuVjaixw

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1080	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1056	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1880	aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe
1880	aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1080	1880	aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe	29
PID 1880 wrote to memory of 1080	1880	aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe	29
PID 1880 wrote to memory of 1080	1880	aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe	29
PID 1880 wrote to memory of 1080	1880	aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe	29
PID 1080 wrote to memory of 1056	1080	cmd.exe	31
PID 1080 wrote to memory of 1056	1080	cmd.exe	31
PID 1080 wrote to memory of 1056	1080	cmd.exe	31
PID 1080 wrote to memory of 1056	1080	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe
"C:\Users\Admin\AppData\Local\Temp\aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del aa9797dc9e9c56d4bca8126a161402b720340b1c524396c3458e28e769ecffed.exe
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-57-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download