Analysis
-
max time kernel
55s -
max time network
92s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 02:39
Static task
static1
Behavioral task
behavioral1
Sample
8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe
Resource
win10v2004-20221111-en
General
-
Target
8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe
-
Size
116KB
-
MD5
a9bf6fadfb6557cbc6654dfc5e43fabd
-
SHA1
046b29c55e05cd45f314218c1b8309e69c7239ba
-
SHA256
8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53
-
SHA512
001f6359d916e0616b1b98d4e0ec37a9aa41a58b4d58b24318e80a9f57f5b89b7f58d5f0b41df7328545f007bf437765bdedda24b18498de78c807d767cbb587
-
SSDEEP
3072:tAxHwOb3hD3ZH4/9daEYP2GgmPPevtzB/oRxrx:tAxLl3ZH4/9QEg1PeFyJ
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 860 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 860 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1336 8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1336 wrote to memory of 1784 1336 8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe 30 PID 1336 wrote to memory of 1784 1336 8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe 30 PID 1336 wrote to memory of 1784 1336 8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe 30 PID 1336 wrote to memory of 1784 1336 8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe 30 PID 1784 wrote to memory of 860 1784 cmd.exe 32 PID 1784 wrote to memory of 860 1784 cmd.exe 32 PID 1784 wrote to memory of 860 1784 cmd.exe 32 PID 1784 wrote to memory of 860 1784 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe"C:\Users\Admin\AppData\Local\Temp\8ceb6b0f210d97f13bfde97d4f2a6f60fdf26b76ddfb6113f32d0eb50761ba53.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 8ceb6b0f210d97f13bfde97d4f2a6f60fd2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-