2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2 | Triage

Analysis

max time kernel
1s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:38

Sharing

Report Analysis Logs

General

Target

18c7c940bc6a4e778fbdf4a3e28151a8.exe
Size

79KB
MD5

18c7c940bc6a4e778fbdf4a3e28151a8
SHA1

f3589918d71b87c7e764479b79c4a7b485cb746a
SHA256

2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2
SHA512

6e808fe882640a517c2054fdece73059c7ea3e27a946e55f41b91fd0f757dcd8c76be8f381f60f3e45449edebaa4f620b903337727607f7768543b1acec40d18
SSDEEP

1536:+nICS4ArFnRoHhcVyid9EZZoi+zQXFpVX42N:5ZnmqVyq9EN+Mb7

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe

Modifies Control Panel 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International	18c7c940bc6a4e778fbdf4a3e28151a8.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeDebugPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: 36	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeImpersonatePrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeIncBasePriorityPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeIncreaseQuotaPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: 33	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeManageVolumePrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeProfSingleProcessPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeRestorePrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeSecurityPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeSystemProfilePrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeTakeOwnershipPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeShutdownPrivilege	2628	18c7c940bc6a4e778fbdf4a3e28151a8.exe
Token: SeBackupPrivilege	1676	vssvc.exe
Token: SeRestorePrivilege	1676	vssvc.exe
Token: SeAuditPrivilege	1676	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\18c7c940bc6a4e778fbdf4a3e28151a8.exe
"C:\Users\Admin\AppData\Local\Temp\18c7c940bc6a4e778fbdf4a3e28151a8.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-1-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/2628-0-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download