Analysis
-
max time kernel
143s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
16-02-2023 19:46
Behavioral task
behavioral1
Sample
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
Resource
win10v2004-20221111-en
General
-
Target
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
-
Size
1.2MB
-
MD5
49c34070396a4eb8ded1fa942dbcbf05
-
SHA1
80d766901ca88857d5d7494c567e57d8994f3bf7
-
SHA256
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76
-
SHA512
53dc7c8f9ac4837f11885fe88d0934804a0cd028be7d8548ed72203e9bc49d76d3081a872991a8f5be5642fbf687ebdb78483722117b4095b9d14d780ca551fa
-
SSDEEP
24576:6zs2R3wI4Azj7HARBCZKr7GxVX/ZwZpKhS/Gu6UKCOcL0wayR5:6zsYz4AX7gRBWWqxVX/aX//GjU4Y
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1352-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-60-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-63-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-67-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-65-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-71-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-69-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-75-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-77-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-81-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-85-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-83-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-79-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-73-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-89-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-91-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-87-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-93-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-95-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-99-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-103-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-101-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-97-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1352-105-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exedescription pid process Token: SeDebugPrivilege 1352 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe Token: SeDebugPrivilege 1352 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exepid process 1352 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe 1352 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe 1352 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe"C:\Users\Admin\AppData\Local\Temp\8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1352-54-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB
-
memory/1352-55-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB
-
memory/1352-56-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB
-
memory/1352-57-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB
-
memory/1352-58-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-60-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-62-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-63-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-67-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-65-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-71-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-69-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-75-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-77-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-81-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-85-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-83-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-79-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-73-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-89-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-91-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-87-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-93-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-95-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-99-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-103-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-101-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-97-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-104-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB
-
memory/1352-105-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1352-106-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB