Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 19:30
Static task
static1
Behavioral task
behavioral1
Sample
e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
General
-
Target
e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe
-
Size
1.0MB
-
MD5
f78da74d5a3e58750613ac73fa693159
-
SHA1
10589e7140e51563bb4f513e60b78b6f5a330354
-
SHA256
e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055
-
SHA512
b89742fac25dc829fadb0d16d27b89e1fa94489c1d6f156337d4fd24e86aa4e67bd4923e6176c72f5874a3d5cb99fbb05278b76d9d8da1d529f02121efd47d31
-
SSDEEP
24576:BY5QsHPi4NNUowtPCVfkpXyy2Ixik181C8YN:BKbHPX/i/8622
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe Token: SeDebugPrivilege 1380 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe 1380 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1004 wrote to memory of 1380 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 28 PID 1004 wrote to memory of 1380 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 28 PID 1004 wrote to memory of 1380 1004 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe"C:\Users\Admin\AppData\Local\Temp\e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\System32\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380
-