9829cb0edf5920a3e03ec5340644eeccf59500f6bf9eb56056783497a679517d

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9829cb0edf5920a3e03ec5340644eeccf59500f6bf9eb56056783497a679517d.exe
Size

72KB
MD5

cbb4c27a924bff09f9243dd2b11c8a0d
SHA1

7ac8e667c8fca98196cf3aa54763b37c766b03d8
SHA256

9829cb0edf5920a3e03ec5340644eeccf59500f6bf9eb56056783497a679517d
SHA512

86aa26927e627aa8217b13fa4953068752d5d0dd5f68a2bb399c69ca6f33ddcf87b2be23822321e328423376debbbca8f53da56bab42e01ae1c4d00cbba6fbf1
SSDEEP

1536:omq8aAPXEHgNXYYKAwws3wrmTxsgGA/x6TduUS8B2:omcGKKh1wMqTjGA/YTA42

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s.exe	9829cb0edf5920a3e03ec5340644eeccf59500f6bf9eb56056783497a679517d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
996	9829cb0edf5920a3e03ec5340644eeccf59500f6bf9eb56056783497a679517d.exe

C:\Users\Admin\AppData\Local\Temp\9829cb0edf5920a3e03ec5340644eeccf59500f6bf9eb56056783497a679517d.exe
"C:\Users\Admin\AppData\Local\Temp\9829cb0edf5920a3e03ec5340644eeccf59500f6bf9eb56056783497a679517d.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download