a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a

Analysis

max time kernel
75s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Size

1.0MB
MD5

01783c573faf04b5a7dcc128217b77f4
SHA1

1dbeb23368265d988c7d928678df0d44485eca9f
SHA256

a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a
SHA512

41e5089366577f0e111a4f5c3c6c19e559ad140a5754c5afaec71f949c581752e27e386026811d529fcbd50c90574689850b2fb7b0da68ccb4402fa2d279a731
SSDEEP

24576:Bb/nPgxVMWmE3G9zK9OGVs+t3EX/a/4aQg99:pAx+c3GE9OEEXCwlg

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	1048	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	1048	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: 33	1048	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	1048	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: 33	3168	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	3168	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: 33	2248	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
Token: SeIncBasePriorityPrivilege	2248	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 3168	1048	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	80
PID 1048 wrote to memory of 3168	1048	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	80
PID 1048 wrote to memory of 3168	1048	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	80
PID 3168 wrote to memory of 2248	3168	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	81
PID 3168 wrote to memory of 2248	3168	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	81
PID 3168 wrote to memory of 2248	3168	a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe	81

C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
"C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
  PECMD**pecmd-cmd* MAIN
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\a8f69935a8b1def74b64a90817115b143996f0b845561c13c711ca00ddcab90a.exe
    PECMD**pecmd-cmd* LOAD *qk #20:INDATA U 32768
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...