84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14

Analysis

max time kernel
100s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe
Size

376KB
MD5

8fbe0a3c278fbe6b563b705415ed09d7
SHA1

19d47517cdd42600c371e3be6bb84ee0925416bc
SHA256

84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14
SHA512

2cbaa0db8cb91b9622abedafd85880230b187554bf38efa9ffa263e6611d54f4b7b2bd0abe8663dd829567938ab1968b7ced5265f0c0c49bc67430450c835f29
SSDEEP

6144:rUnEDoeSxaC1PNT5+nXPdrmwvupvzsgrE:wEDdrCWUsj

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
572	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1996	84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe
1996	84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe
1996	84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1212	1996	84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe	28
PID 1996 wrote to memory of 1212	1996	84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe	28
PID 1996 wrote to memory of 1212	1996	84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe	28
PID 1996 wrote to memory of 1212	1996	84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe	28

C:\Users\Admin\AppData\Local\Temp\84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe
"C:\Users\Admin\AppData\Local\Temp\84f44882e11f762210b1a312b5fe8b20aababaadf17bcb73969ad73bc52ece14.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\sample1.jpg
  2⤵
  PID:1212

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\sample1.jpg

Filesize
6KB

MD5
6ae6f4187bcc691a85f5d5a70d014830

SHA1
3a3ea84513c808f82c97d8e8a271c690ce8768e5

SHA256
09c817d27da3d0740fd4128bf630c740dd98d754ba3c52c653f38e097bc05090

SHA512
931f15581172f7856ff4ceb627723af0e7a690f009b39b6da8e6dbb1db32334d0e56ebf76c7189ac39602df4040ce52bd4cba8e5f41dd604e854209add4f1c97

Download Submit
memory/1996-56-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download