Analysis

  • max time kernel
    55s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2022 02:39

General

  • Target

    8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe

  • Size

    116KB

  • MD5

    a9bf6fadfb6557cbc6654dfc5e43fabd

  • SHA1

    046b29c55e05cd45f314218c1b8309e69c7239ba

  • SHA256

    8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53

  • SHA512

    001f6359d916e0616b1b98d4e0ec37a9aa41a58b4d58b24318e80a9f57f5b89b7f58d5f0b41df7328545f007bf437765bdedda24b18498de78c807d767cbb587

  • SSDEEP

    3072:tAxHwOb3hD3ZH4/9daEYP2GgmPPevtzB/oRxrx:tAxLl3ZH4/9QEg1PeFyJ

Score
6/10

Malware Config

Signatures

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe
    "C:\Users\Admin\AppData\Local\Temp\8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del 8ceb6b0f210d97f13bfde97d4f2a6f60fd
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1784
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/860-58-0x0000000000000000-mapping.dmp

  • memory/1336-56-0x0000000075F01000-0x0000000075F03000-memory.dmp

    Filesize

    8KB

  • memory/1784-57-0x0000000000000000-mapping.dmp