Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 04:29
Behavioral task
behavioral1
Sample
e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe
-
Size
681KB
-
MD5
27add3faa0e0fea2bb56df4740650f90
-
SHA1
1b275adf0315d78a66a92f8da79e894cef58c9c8
-
SHA256
e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f
-
SHA512
c3fc386ee8f5c834427fa6afa78ffac31e0b92888da189c26c26be29aa4ec02f718a0c4342ec46e342222ad8ab878e2e730fb4c6e90542ccc56265d2254385df
-
SSDEEP
12288:ck0QNlxOnizg37k4LUSd0rv5WvYW5HMzLXj9pqQd7cqESAYi991fA/aVJL:90QpGih4bd0rv5+l5szLXj917cqPu911
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exedescription pid process Token: SeIncreaseQuotaPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeSecurityPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeTakeOwnershipPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeLoadDriverPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeSystemProfilePrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeSystemtimePrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeProfSingleProcessPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeIncBasePriorityPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeCreatePagefilePrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeBackupPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeRestorePrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeShutdownPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeDebugPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeSystemEnvironmentPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeChangeNotifyPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeRemoteShutdownPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeUndockPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeManageVolumePrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeImpersonatePrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: SeCreateGlobalPrivilege 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: 33 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: 34 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: 35 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe Token: 36 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exepid process 1932 e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe"C:\Users\Admin\AppData\Local\Temp\e083f87f2e1b7d29700705f851c3d84e8e38d41ea44213b2b06c31057a46173f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx