Analysis
-
max time kernel
19s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe
-
Size
106KB
-
MD5
0e9b48f6928bb88abdf12e31f3ce6150
-
SHA1
2e5c3aaa3a24d7a92b676b610d74211ee9e86472
-
SHA256
6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51
-
SHA512
6415f8efc1a037f9d227eda30025cf666879b926f57f0bb0f1892d647ba1aac2f9c23bf3c952f3b8b6da643220f88ce9bbec4aca32c05bda2d15ed98d0d529f5
-
SSDEEP
1536:bF/pRGlFsVCWaPN19c4x/hB94Z8FqiZ+qExM:RKwVCfN3ceXNAqt
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 540 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1656 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1656 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1912 wrote to memory of 540 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 30 PID 1912 wrote to memory of 540 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 30 PID 1912 wrote to memory of 540 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 30 PID 1912 wrote to memory of 540 1912 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe 30 PID 540 wrote to memory of 1656 540 cmd.exe 32 PID 540 wrote to memory of 1656 540 cmd.exe 32 PID 540 wrote to memory of 1656 540 cmd.exe 32 PID 540 wrote to memory of 1656 540 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe"C:\Users\Admin\AppData\Local\Temp\6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 6e99fce3346faa51e6d9a6c9440f4fe7b235678b48095fb6bf21859ca9077b51.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-