0661acbceb4a5546dea66bfb65c77836e434db7bf4c22e9ac99df8f25cda5fb6

Analysis

max time kernel
582s
max time network
401s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12-07-2023 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
Size

114KB
MD5

decc2726599edcae8d1d1d0ca99d83a6
SHA1

0d8cc992f279ec45e8b8dfd05a700ff1f0437f29
SHA256

3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767
SHA512

1096ccabe0c99ab73bbc92c645814b6590f5a925801eb3a97e9930e3bc668738f8852e83628474836ba15983b6660eb5c2f2741e925d16877991ca89be47f49a
SSDEEP

1536:bV3+WmNcWDurilmw9BgjKu1sPPxaS4jqY:bV3+WmjDxlPwV16PkS4jqY

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\jldr	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
File opened for modification	C:\Windows\system32\Drivers\jldr	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
File created	C:\Windows\system32\Drivers\jldr.sys	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_Classes\Local Settings rundll32.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

Notepad.exe

pid process

1412 Notepad.exe
Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

464
464
464
464
464

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_Classes\Local Settings	rundll32.exe

pid	process
1412	Notepad.exe

pid	process
464
464
464
464
464

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe

description	pid	process
Token: 0	2364	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
Token: SeBackupPrivilege	2364	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
Token: SeLoadDriverPrivilege	2364	3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe

C:\Users\Admin\AppData\Local\Temp\3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
"C:\Users\Admin\AppData\Local\Temp\3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\WaitDeny.mpp
1⤵
- Modifies registry class
PID:988

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\SearchBackup.vbe
1⤵
- Opens file in notepad (likely ransom note)
PID:1412

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\SearchBackup.vbe"
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads