649c75d99b6d8e237d8a8d0142796fcbfa7381674628201f474b58039144ec2a

Resubmissions

15-11-2024 18:05

241115-wpjcdsxrdy 10

11-11-2024 21:40

241111-1h6xbsxcql 10

03-12-2022 17:54

221203-wg4ncscc33 10

Analysis

max time kernel
225s
max time network
47s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
Size

2.4MB
MD5

989cb0bfa4cc0bd8e8302f47add8e368
SHA1

515b82386397ec822edbce6f24a6c4b9d13b0344
SHA256

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef
SHA512

9211bb8622c7dee790db4847a9095bfd8dc48d324a400f374ab42ce65c1e2295cc6392a16e031282f6b3fa29a1881487016c9b817e05d65420d7db41f4548583
SSDEEP

24576:pu4wFHPSaD/zXFRRhOnYQb6VOOmWC9+HW0MigJS3Cd+XHKrQD2YR:

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

description	pid	process	target process
PID 2016 set thread context of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1548 powershell.exe

pid	process
1548	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exe932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

description	pid	process
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
Token: SeDebugPrivilege	1924	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

description	pid	process	target process
PID 2016 wrote to memory of 1548	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	powershell.exe
PID 2016 wrote to memory of 1548	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	powershell.exe
PID 2016 wrote to memory of 1548	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	powershell.exe
PID 2016 wrote to memory of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
PID 2016 wrote to memory of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
PID 2016 wrote to memory of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
PID 2016 wrote to memory of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
PID 2016 wrote to memory of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
PID 2016 wrote to memory of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
PID 2016 wrote to memory of 1924	2016	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe	932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

C:\Users\Admin\AppData\Local\Temp\932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
"C:\Users\Admin\AppData\Local\Temp\932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Users\Admin\AppData\Local\Temp\932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
  C:\Users\Admin\AppData\Local\Temp\932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-65-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download
memory/1548-58-0x0000000000000000-mapping.dmp

Download
memory/1548-64-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/1548-63-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download
memory/1548-61-0x000007FEEA740000-0x000007FEEB29D000-memory.dmp

Filesize
11.4MB

Download
memory/1548-60-0x000007FEEB2A0000-0x000007FEEBCC3000-memory.dmp

Filesize
10.1MB

Download
memory/1548-62-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/1924-75-0x000000001B150000-0x000000001B1F4000-memory.dmp

Filesize
656KB

Download
memory/1924-72-0x0000000140000000-mapping.dmp

Download
memory/1924-79-0x000000001B756000-0x000000001B775000-memory.dmp

Filesize
124KB

Download
memory/1924-78-0x000000001B280000-0x000000001B2D4000-memory.dmp

Filesize
336KB

Download
memory/1924-77-0x0000000000EA0000-0x0000000000EEC000-memory.dmp

Filesize
304KB

Download
memory/1924-66-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/1924-67-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/1924-71-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/1924-76-0x0000000000CB0000-0x0000000000CFE000-memory.dmp

Filesize
312KB

Download
memory/1924-69-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/2016-57-0x000000001D0F0000-0x000000001D182000-memory.dmp

Filesize
584KB

Download
memory/2016-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x000000001C5B0000-0x000000001C6E6000-memory.dmp

Filesize
1.2MB

Download
memory/2016-54-0x0000000001270000-0x00000000014D6000-memory.dmp

Filesize
2.4MB

Download