a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a

Analysis

max time kernel
43s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Size

1.0MB
MD5

01783c573faf04b5a7dcc128217b77f4
SHA1

1dbeb23368265d988c7d928678df0d44485eca9f
SHA256

a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a
SHA512

41e5089366577f0e111a4f5c3c6c19e559ad140a5754c5afaec71f949c581752e27e386026811d529fcbd50c90574689850b2fb7b0da68ccb4402fa2d279a731
SSDEEP

24576:Bb/nPgxVMWmE3G9zK9OGVs+t3EX/a/4aQg99:pAx+c3GE9OEEXCwlg

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: 33	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: 33	912	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	912	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: 33	1900	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	1900	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 912	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	27
PID 1116 wrote to memory of 912	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	27
PID 1116 wrote to memory of 912	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	27
PID 1116 wrote to memory of 912	1116	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	27
PID 912 wrote to memory of 1900	912	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	28
PID 912 wrote to memory of 1900	912	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	28
PID 912 wrote to memory of 1900	912	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	28
PID 912 wrote to memory of 1900	912	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	28

C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
"C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
  PECMD**pecmd-cmd* MAIN
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
    PECMD**pecmd-cmd* LOAD *qk #20:INDATA U 32768
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download