5ab1b5c6441512297d7523334bdb92dbee7f35ad76901d7f199bc9d5a1223457

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 09:26

Target

9549168790bc8b01d0c889fccb01bd73.exe
Size

5KB
MD5

9549168790bc8b01d0c889fccb01bd73
SHA1

3e0091a6e3d0e793c28056a19bbd882ff6992dea
SHA256

5ab1b5c6441512297d7523334bdb92dbee7f35ad76901d7f199bc9d5a1223457
SHA512

1f6eb588a7c2eba76d98e2d4662f855c4936070a9cf713b29bd8354e3fa5a298ebf565f2e7bbb3b1f6ce03640120b44b87097d50824e2ab137a26f60c76314bf
SSDEEP

96:pdr479SSCFQQQ+tpwvk+JcAY+sGwvk+JwnSvFd3ojdrl:pdi9SZFVHcvk2YgwvkLaFdw

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 920 powershell.exe
5 920 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

920 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 920 powershell.exe

flow	pid	process
4	920	powershell.exe
5	920	powershell.exe

pid	process
920	powershell.exe

description	pid	process
Token: SeDebugPrivilege	920	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9549168790bc8b01d0c889fccb01bd73.exe

description	pid	process	target process
PID 1336 wrote to memory of 920	1336	9549168790bc8b01d0c889fccb01bd73.exe	powershell.exe
PID 1336 wrote to memory of 920	1336	9549168790bc8b01d0c889fccb01bd73.exe	powershell.exe
PID 1336 wrote to memory of 920	1336	9549168790bc8b01d0c889fccb01bd73.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\9549168790bc8b01d0c889fccb01bd73.exe
"C:\Users\Admin\AppData\Local\Temp\9549168790bc8b01d0c889fccb01bd73.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/920-59-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/920-60-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/920-61-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/920-62-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/920-63-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/920-64-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/920-65-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/920-66-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/920-67-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/920-68-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1336-54-0x0000000000820000-0x0000000000828000-memory.dmp

Filesize
32KB

Download