86ecce68e72fb86d2c8a35eb6e67c8eae520dda16737bb3917b567d37887c0ef

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86ecce68e72fb86d2c8a35eb6e67c8eae520dda16737bb3917b567d37887c0ef.exe
Size 1.6MB
Sample221202-blsfnsdb3v
SHA256 86ecce68e72fb86d2c8a35eb6e67c8eae520dda16737bb3917b567d37887c0ef
MD5 64024b40c0f4f56bc74a7ce42a5f00c1
SHA1 c8b6e1dc7a2a72f0bbe5e2dafb60412dc3069098
SHA512 e9c846397c0533f179ac0e7fc12b5a988d35819d3b996b4475da9131c9921018f71d0120ea6e80b85adcd133a6ca831fc3003a6e8871e390938a41153e9accdb
SSDEEP 49152:AzL5PSdj7gIwee5+nsEe0FhNCpZwgPzEr8oGPJ4Ka60hKp:AzdSd/gIw95+nsEeuhNCPwgPIgZP7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4216	86ecce68e72fb86d2c8a35eb6e67c8eae520dda16737bb3917b567d37887c0ef.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	86ecce68e72fb86d2c8a35eb6e67c8eae520dda16737bb3917b567d37887c0ef.exe

C:\Users\Admin\AppData\Local\Temp\86ecce68e72fb86d2c8a35eb6e67c8eae520dda16737bb3917b567d37887c0ef.exe
"C:\Users\Admin\AppData\Local\Temp\86ecce68e72fb86d2c8a35eb6e67c8eae520dda16737bb3917b567d37887c0ef.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4216-132-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/4216-133-0x0000000000400000-0x000000000059F000-memory.dmp