afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf

Analysis

max time kernel
152s
max time network
183s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe
Size

283KB
MD5

13ff7125821bc90d9d22ac62233bea0e
SHA1

9c868edd4a9684cbd367527403b07c9654027c89
SHA256

afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf
SHA512

aba0d2d3af8ee3e0d94b5c8bb6399ea33fe4127ca770b3fbd86f5974c6cc2a0e4804424aae198a59d4a9d3eaf4d34ba4033e9a50ddfc8eb520def0153b16899f
SSDEEP

6144:/w6JOerGp2aPeiyx+/Hqyo3ia/keIJSkH364n8LQTj3Fv0B2fJLY4:/wurYPex+/2rXI5XxBj3GMfJ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1104	afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe
1104	afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe
1104	afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe

C:\Users\Admin\AppData\Local\Temp\afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe
"C:\Users\Admin\AppData\Local\Temp\afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dfs7BC5.tmp

Filesize
496KB

MD5
93fde31f598bbfb7b0822648d4a83889

SHA1
9b7194bbdcee2ed5ee95769a79e44dcb1c848944

SHA256
2bcf933a8542f0df471a459e3a37408c1209fbe367bcd738e7d7a1700a36f983

SHA512
ee6ba0aafe8b2830ff5f8986be652f097f65632252abd55abefa4fd2e4269afdd62387ea5faff110da77463418b2e4406d5a3dc1ac7c884b7f676bff4b4e07cf

Download Submit
\Users\Admin\AppData\Local\Temp\dfs7BC5.tmp

Filesize
496KB

MD5
93fde31f598bbfb7b0822648d4a83889

SHA1
9b7194bbdcee2ed5ee95769a79e44dcb1c848944

SHA256
2bcf933a8542f0df471a459e3a37408c1209fbe367bcd738e7d7a1700a36f983

SHA512
ee6ba0aafe8b2830ff5f8986be652f097f65632252abd55abefa4fd2e4269afdd62387ea5faff110da77463418b2e4406d5a3dc1ac7c884b7f676bff4b4e07cf

Download Submit
memory/1104-56-0x00000000003C0000-0x0000000000442000-memory.dmp

Filesize
520KB

Download
memory/1104-57-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1104-58-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1104-59-0x0000000000ED0000-0x0000000000F8A000-memory.dmp

Filesize
744KB

Download
memory/1104-60-0x0000000000080000-0x0000000000083000-memory.dmp

Filesize
12KB

Download
memory/1104-61-0x0000000000080000-0x0000000000083000-memory.dmp

Filesize
12KB

Download
memory/1104-62-0x0000000000517000-0x0000000000528000-memory.dmp

Filesize
68KB

Download
memory/1104-63-0x0000000000517000-0x0000000000528000-memory.dmp

Filesize
68KB

Download
memory/1104-64-0x000000000A530000-0x000000000ACD6000-memory.dmp

Filesize
7.6MB

Download