b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8

Analysis

max time kernel
168s
max time network
173s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe
Size

329KB
MD5

415f9f7c54087ade20df068bb2fb20cf
SHA1

cf2df0afe498df08304ef6b11a6dd5e1fa572915
SHA256

b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8
SHA512

48a94af0e0f450bd671cd09a124100c664c1eaafe00b8bac2779b414aeae5d1330cb32841e037b787fdb0c3660546f115198ba8782081a4f22119c8feeb35f84
SSDEEP

6144:oFSJry9l99YeXc6ChVFvfdXpO8swhfLATHCYm+AKthZnysqDnVNRPwoxYrYBei6v:nY9l9Sxb9fd5O8JxL46+AaDysatwoxYV

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1028	b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe
1028	b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1028	b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe
1028	b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe

C:\Users\Admin\AppData\Local\Temp\b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe
"C:\Users\Admin\AppData\Local\Temp\b0669f246b4e457e8caa9ebceb29f48222fe699251f98d54ff4e460e527d26e8.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dfs450D.tmp

Filesize
496KB

MD5
101253c625eb493e8370d2620e915146

SHA1
263b79d7e28fbc52223ef817aea7f8b9a060e73c

SHA256
9bab4695daa00369eb8023a872dc1cfbfc25af0ebb2607149e494ef94b332788

SHA512
d1d479545c894c3565df740198a7e31866c0bb563c42a5b040c5670483ee5c18fffcc437643a1a79901bb1c2f255d009f27bae7d944b5e5366b59217db95bb7b

Download Submit
\Users\Admin\AppData\Local\Temp\dfs450D.tmp

Filesize
496KB

MD5
101253c625eb493e8370d2620e915146

SHA1
263b79d7e28fbc52223ef817aea7f8b9a060e73c

SHA256
9bab4695daa00369eb8023a872dc1cfbfc25af0ebb2607149e494ef94b332788

SHA512
d1d479545c894c3565df740198a7e31866c0bb563c42a5b040c5670483ee5c18fffcc437643a1a79901bb1c2f255d009f27bae7d944b5e5366b59217db95bb7b

Download Submit
memory/1028-56-0x0000000000DC0000-0x0000000000E42000-memory.dmp

Filesize
520KB

Download
memory/1028-57-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/1028-58-0x0000000000EA0000-0x0000000000F73000-memory.dmp

Filesize
844KB

Download
memory/1028-59-0x0000000000130000-0x0000000000133000-memory.dmp

Filesize
12KB

Download
memory/1028-60-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1028-61-0x00000000048D7000-0x00000000048E8000-memory.dmp

Filesize
68KB

Download
memory/1028-62-0x000000000A510000-0x000000000ACB6000-memory.dmp

Filesize
7.6MB

Download
memory/1028-63-0x0000000000130000-0x0000000000133000-memory.dmp

Filesize
12KB

Download
memory/1028-64-0x00000000048D7000-0x00000000048E8000-memory.dmp

Filesize
68KB

Download