34cecd5a9044d95734b6b8876695e1f4f0a98c852902af352cfdfe15dab18cc3

Resubmissions

23-01-2023 14:03

230123-rctv5sfb2w 10

23-01-2023 13:59

230123-ran7wafa9v 10

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Paid_Offer_83_Jan_19.iso
Size

2.1MB
MD5

ff20b342043378b018b88b39d572dfc5
SHA1

d69b4ef00f4635c01302767bbdbb0a24bd7bb9fa
SHA256

2189c2323d2e626f7daa81eeccb6cfb225d3866a0d4532aef070711ac59b09c7
SHA512

e428688b9ef005a1e2ab75a3e2b25b0887bbdac44d145e9cb2957f050d3aa26782157acb82d03755fb487fe15539d3ab44d68fac4cc20cd7565a6c290e49f00a
SSDEEP

24576:rkmZDEMHhp9v1Ikbn3ND0TAVOsIut8P4zlIKE2r/7Bk:QmZFHhp9v1Io3h0TA3pJk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 4756 cmd.exe
Token: SeManageVolumePrivilege 4756 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	4756	cmd.exe
Token: SeManageVolumePrivilege	4756	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Paid_Offer_83_Jan_19.iso
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads