8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22

Analysis

max time kernel
115s
max time network
142s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe
Size

594KB
MD5

feeed083fe45f04fb14f8a3418d7d98a
SHA1

8e288bffe12a58f2a2e08a674fac52dae6f40d6f
SHA256

8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22
SHA512

0036e17ea758f52e87448036e993fc7f851fd56b12b398f002769a95a168a131e56e980098e6bc32e66301cf503e7575cfb2c844fafa6994521b53263a61b665
SSDEEP

12288:yR+RmyZD0gXwFwi0efIe4qNP0cu11xOfbsBo6aHBcQcSgW+DidVkIk:yRWZ4fhZrmUfQBCHBXcSJ+yPk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1732	8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe
Token: SeIncBasePriorityPrivilege	1732	8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1732	2016	8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe	27
PID 2016 wrote to memory of 1732	2016	8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe	27
PID 2016 wrote to memory of 1732	2016	8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe	27
PID 2016 wrote to memory of 1732	2016	8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe	27

C:\Users\Admin\AppData\Local\Temp\8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe
"C:\Users\Admin\AppData\Local\Temp\8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe
  "C:\Users\Admin\AppData\Local\Temp\8f14de887a8e211fa59817f8bee4b78aef31ee951ab392f9094f43950d820e22.exe" 1 44964
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-66-0x0000000001FD0000-0x0000000002088000-memory.dmp

Filesize
736KB

Download
memory/1732-72-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1732-73-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2016-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000002AE0000-0x0000000002B98000-memory.dmp

Filesize
736KB

Download
memory/2016-64-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download