925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
Size

35KB
MD5

15509dc5654ead496e545aa2b4899fb4
SHA1

448f663db5c56c92a0b28150b26a1a3ca738ccdd
SHA256

925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef
SHA512

0843a781466618a188b31debdd58b447e04f6e8bdd968917f5552866efc1f2cdb68de6408c420df40cd43e24fd6d4db38e867e5a7f32d0eda012f753c58926f7
SSDEEP

768:pKgphok5Fvwh62at6oBC8F7mlXPw4AwySaEtVvwIioyPyYebfC:pKMfwM2ae8F78Pw4ASDVIIpyaxfC

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1036	cmd.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program files\MSDN\LHL13.sys	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
File created	C:\Program files\MSDN\000000001	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
File opened for modification	C:\Program files\MSDN\000000001	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
File created	C:\Program files\MSDN\hehex.sys	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
Token: SeDebugPrivilege	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
Token: SeDebugPrivilege	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1352	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	26
PID 2020 wrote to memory of 1352	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	26
PID 2020 wrote to memory of 1352	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	26
PID 2020 wrote to memory of 1352	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	26
PID 2020 wrote to memory of 1352	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	26
PID 2020 wrote to memory of 1352	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	26
PID 2020 wrote to memory of 1352	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	26
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15
PID 2020 wrote to memory of 1412	2020	925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe
  "C:\Users\Admin\AppData\Local\Temp\925c02c415c9b8f354c652cb5aa8d90532079503b12c2a363812b3447032c1ef.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c time 03:32:00
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\t.bat" "
    3⤵
    - Deletes itself
    PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\t.bat

Filesize
252B

MD5
49d8f1dcf7b5c5455d2ab5e143b8d7f0

SHA1
19dbfc093bbb0f11d267f4475373016f60cf3676

SHA256
8c18e0226b8fc35390c1956c2980609255826b38d7ff1395c1e0e9ba29286643

SHA512
08884ba96c4066957bb78081c5e18b08e91031d95bf1750f2fa1f1ca74ff49bb45ba54875443535828c9f3cc180d8309442b968431d9c278c0d57010dcd75959

Download Submit
memory/1412-56-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-57-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-58-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-59-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-60-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-61-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-62-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-63-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-64-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-65-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-66-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-67-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-68-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-69-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-70-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-71-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-72-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-73-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-74-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-75-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-76-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-77-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-78-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-79-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-80-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-81-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-82-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-83-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-84-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-85-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-86-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-87-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-88-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-89-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-90-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-91-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-92-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-93-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-94-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-95-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-96-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-97-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-98-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-99-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-100-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-101-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-102-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-103-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-104-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-105-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-106-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-107-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-108-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-109-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-110-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-111-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-112-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-113-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-114-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-115-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-116-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-117-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1412-118-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000000490000-0x0000000000495000-memory.dmp

Filesize
20KB

Download