Analysis
-
max time kernel
52s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/02/2023, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
ReduceMemory/ReduceMemory.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
ReduceMemory/ReduceMemory.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ReduceMemory/ReduceMemory_x64.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
ReduceMemory/ReduceMemory_x64.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
ReduceMemory/ReduceMemory.exe
-
Size
776KB
-
MD5
0d626331715cc35aa377a8503f85c92a
-
SHA1
26aad89595f00068151d3676297ceec394e718af
-
SHA256
3e541100c869dba06ee62252a9661e5a06c2e685a7ddd5288ea1358703412385
-
SHA512
6dcdc39672dd00873c55753ba02ad05dc61ef028a4de385d5af38f30c4959342ac25f0ae936a19fb29100a49ab379f16f5288578434e1aea83b03e596d999996
-
SSDEEP
12288:UaWzgMg7v3qnCiHErQohh0F4aCJ8lny7QSpJJ9vZ+dAy2s:LaHMv6C7rjCny7QQx+Is
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1008 ReduceMemory.exe 1008 ReduceMemory.exe 1008 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1008 ReduceMemory.exe Token: SeAssignPrimaryTokenPrivilege 1008 ReduceMemory.exe Token: SeIncreaseQuotaPrivilege 1008 ReduceMemory.exe Token: 0 1008 ReduceMemory.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe -
Suspicious use of SendNotifyMessage 52 IoCs
pid Process 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe 336 ReduceMemory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ReduceMemory\ReduceMemory.exe"C:\Users\Admin\AppData\Local\Temp\ReduceMemory\ReduceMemory.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\ReduceMemory\ReduceMemory.exeC:\Users\Admin\AppData\Local\Temp\ReduceMemory\ReduceMemory.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:336
-