Analysis
-
max time kernel
146s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-02-2023 18:34
Behavioral task
behavioral1
Sample
6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe
Resource
win10v2004-20221111-en
General
-
Target
6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe
-
Size
119KB
-
MD5
1f55506bd2a51f3998c3ec816f9a9497
-
SHA1
10809e2f572d62444564b6567d0633b64933ba0d
-
SHA256
6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863
-
SHA512
091c5fbdd5cf8b5b6dab89c67e51aec5b7e9f093bef55ebf0c0f3116b02c69191419a5fcea97c5b2373eff65c1f0e1d6e715b1b413b439928ce58c91763b48ac
-
SSDEEP
3072:9RO1LF0fIcLtQsaZloe5aRDeJ/jt7VqTWVhZdlj:9PfIOQs69x7yAhh
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exedescription pid process Token: SeDebugPrivilege 1676 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exepid process 1676 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe 1676 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe 1676 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe 1676 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe 1676 6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe"C:\Users\Admin\AppData\Local\Temp\6116b8883d3da8e2949e38ccf4c7e8d491346f00888f0f1a94a83616f8923863.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1676