a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0

Analysis

max time kernel
2s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe
Size

88KB
MD5

685ce1a6c2afd7b5d1e7bb8f41a0fc34
SHA1

918538424dae4dd06431b1cd7e2193bd18579152
SHA256

a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0
SHA512

d514e7627859803ef094374b57a5bf0f4ca2e016b19cb99b527c5bcc5c9728990b6c71b8bba733551559bb20f66870ea750361ac7434f0087a1e0264026bc1d5
SSDEEP

1536:35eUs37Uit8A5+e9+T/9FF1aboQthIkaiydi:peUsriA5+0C/9cbrAa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
952	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeRestorePrivilege	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe
Token: SeBackupPrivilege	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe
Token: SeRestorePrivilege	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe
Token: SeBackupPrivilege	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 952	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	28
PID 1716 wrote to memory of 952	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	28
PID 1716 wrote to memory of 952	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	28
PID 1716 wrote to memory of 952	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	28
PID 1716 wrote to memory of 108	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	31
PID 1716 wrote to memory of 108	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	31
PID 1716 wrote to memory of 108	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	31
PID 1716 wrote to memory of 108	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	31
PID 1716 wrote to memory of 108	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	31
PID 1716 wrote to memory of 108	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	31
PID 1716 wrote to memory of 108	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	31
PID 1716 wrote to memory of 580	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	32
PID 1716 wrote to memory of 580	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	32
PID 1716 wrote to memory of 580	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	32
PID 1716 wrote to memory of 580	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	32
PID 1716 wrote to memory of 580	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	32
PID 1716 wrote to memory of 580	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	32
PID 1716 wrote to memory of 580	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	32
PID 1716 wrote to memory of 672	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	33
PID 1716 wrote to memory of 672	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	33
PID 1716 wrote to memory of 672	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	33
PID 1716 wrote to memory of 672	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	33
PID 1716 wrote to memory of 672	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	33
PID 1716 wrote to memory of 672	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	33
PID 1716 wrote to memory of 672	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	33
PID 1716 wrote to memory of 1404	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	34
PID 1716 wrote to memory of 1404	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	34
PID 1716 wrote to memory of 1404	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	34
PID 1716 wrote to memory of 1404	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	34
PID 1716 wrote to memory of 1404	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	34
PID 1716 wrote to memory of 1404	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	34
PID 1716 wrote to memory of 1404	1716	a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe	34

C:\Users\Admin\AppData\Local\Temp\a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe
"C:\Users\Admin\AppData\Local\Temp\a6132fbab8b8e175ff44c1e88ba3ea5dd73f33db5ec4131f73dac152053072c0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ZhuDongFangyu.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk
  2⤵
  PID:108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
  2⤵
  PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk
  2⤵
  PID:672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk
  2⤵
  PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-59-0x0000000000000000-mapping.dmp

Download
memory/580-61-0x0000000000000000-mapping.dmp

Download
memory/672-63-0x0000000000000000-mapping.dmp

Download
memory/952-56-0x0000000000000000-mapping.dmp

Download
memory/1404-65-0x0000000000000000-mapping.dmp

Download
memory/1716-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1716-58-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1716-67-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download