5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078

Analysis

max time kernel
20s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe
Size

760KB
MD5

06c78c2545dfe8a80681d9698539516c
SHA1

5232c16f5eace6e54da1af5e70171b784e26b7c8
SHA256

5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078
SHA512

5d99286bb9c466effdc7ffb94ed35cb17ea09cb74faf08058414037a85a324fbc0c8dc2092d6d6e301dfcaf127a0a016c8d0a9bf00516f3acf79b5bb5a2f343b
SSDEEP

12288:RRW1HThsdOrJw1vJoov9pbUr7Q9i63qaGfRixnV:RkHThsdOrJw1vJoov9pbPw5ixV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2036	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
916	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe
1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe
1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2036	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	28
PID 1772 wrote to memory of 2036	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	28
PID 1772 wrote to memory of 2036	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	28
PID 1772 wrote to memory of 2036	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	28
PID 1772 wrote to memory of 1716	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	29
PID 1772 wrote to memory of 1716	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	29
PID 1772 wrote to memory of 1716	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	29
PID 1772 wrote to memory of 1716	1772	5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe	29
PID 1716 wrote to memory of 916	1716	cmd.exe	33
PID 1716 wrote to memory of 916	1716	cmd.exe	33
PID 1716 wrote to memory of 916	1716	cmd.exe	33
PID 1716 wrote to memory of 916	1716	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe
"C:\Users\Admin\AppData\Local\Temp\5d34e2503c40c6d61b9c5331daafa9a2a7342d7a0f3890051f2e102a89748078.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im don.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\frsh.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\frsh.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\frsh.txt

Filesize
1KB

MD5
a65687cac575a464a2349e3e27252de4

SHA1
5263ff703d62fae25fdcd83cb29e3e6c41d05a72

SHA256
a3b48da5cf82bd71478bab9031d8e27bbb66975666fa9593274803015b39228b

SHA512
42e7fc3154cecd7e741058284e777ac77e86c632e2283581f628d71af3053c2fed3d3c80206714fe519a84bc0f921a0e51c47e084e5ecf6e0ab335669659416b

Download Submit
memory/916-60-0x0000000000000000-mapping.dmp

Download
memory/1716-58-0x0000000000000000-mapping.dmp

Download
memory/1772-56-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/2036-57-0x0000000000000000-mapping.dmp

Download