6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe
Size

152KB
MD5

0c9c6940a358a8a248f346274f975a03
SHA1

6b1c594e1b92c16c36b68abbd6a700eeb4844a27
SHA256

6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9
SHA512

f85d6fac1a49ca179b4d7dc92e76599e8317c2446cfa394a87cee8138da5d80b6378e0f83c28bd4b4f8bd334b7b418ef0f09fcfa9e8e3c2c5c47f52e78993af0
SSDEEP

3072:do1QyJ/nAd2S/FqGQ2u2642UZO1qBSofwI4PjBI:doBAd2S/AZW2P1qBSooIkB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
316	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
896	6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe
896	6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1560	896	6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe	30
PID 896 wrote to memory of 1560	896	6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe	30
PID 896 wrote to memory of 1560	896	6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe	30
PID 896 wrote to memory of 1560	896	6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe	30
PID 1560 wrote to memory of 316	1560	cmd.exe	32
PID 1560 wrote to memory of 316	1560	cmd.exe	32
PID 1560 wrote to memory of 316	1560	cmd.exe	32
PID 1560 wrote to memory of 316	1560	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe
"C:\Users\Admin\AppData\Local\Temp\6cee729064a9c96e9a8ea62c745ad5a543b8052863eebb6dbd28092840de0bb9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del 6cee729064a9c96e9a8ea62c745ad5a543
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-57-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download