5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3

General

Target
POL 186 22-06-2020.exe
Size 433KB
Sample200624-e1caffkj5j
SHA256 5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3
MD5 1c5110e0f33a33f00cb93f1740e712e0
SHA1 ddfa4f193990f5304565c704200f8e3e0517add1
SHA512 c3595687f459437d3eabb6d294bca852bdc6a6d1eff8419891d6b902c9d1b5ecad53adcd2c07e5525ad8273391b70870399589f55bc9127259fb90f89a197465
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	POL 186 22-06-2020.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 112	1108	POL 186 22-06-2020.exe	24
PID 1108 wrote to memory of 112	1108	POL 186 22-06-2020.exe	24
PID 1108 wrote to memory of 112	1108	POL 186 22-06-2020.exe	24
PID 1108 wrote to memory of 112	1108	POL 186 22-06-2020.exe	24
PID 1108 wrote to memory of 744	1108	POL 186 22-06-2020.exe	26
PID 1108 wrote to memory of 744	1108	POL 186 22-06-2020.exe	26
PID 1108 wrote to memory of 744	1108	POL 186 22-06-2020.exe	26
PID 1108 wrote to memory of 744	1108	POL 186 22-06-2020.exe	26
PID 1108 wrote to memory of 388	1108	POL 186 22-06-2020.exe	27
PID 1108 wrote to memory of 388	1108	POL 186 22-06-2020.exe	27
PID 1108 wrote to memory of 388	1108	POL 186 22-06-2020.exe	27
PID 1108 wrote to memory of 388	1108	POL 186 22-06-2020.exe	27
PID 1108 wrote to memory of 1072	1108	POL 186 22-06-2020.exe	28
PID 1108 wrote to memory of 1072	1108	POL 186 22-06-2020.exe	28
PID 1108 wrote to memory of 1072	1108	POL 186 22-06-2020.exe	28
PID 1108 wrote to memory of 1072	1108	POL 186 22-06-2020.exe	28
PID 1108 wrote to memory of 1656	1108	POL 186 22-06-2020.exe	29
PID 1108 wrote to memory of 1656	1108	POL 186 22-06-2020.exe	29
PID 1108 wrote to memory of 1656	1108	POL 186 22-06-2020.exe	29
PID 1108 wrote to memory of 1656	1108	POL 186 22-06-2020.exe	29
PID 1108 wrote to memory of 1052	1108	POL 186 22-06-2020.exe	30
PID 1108 wrote to memory of 1052	1108	POL 186 22-06-2020.exe	30
PID 1108 wrote to memory of 1052	1108	POL 186 22-06-2020.exe	30
PID 1108 wrote to memory of 1052	1108	POL 186 22-06-2020.exe	30

C:\Users\Admin\AppData\Local\Temp\POL 186 22-06-2020.exe
"C:\Users\Admin\AppData\Local\Temp\POL 186 22-06-2020.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mXpDgbV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8535.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:112
- C:\Users\Admin\AppData\Local\Temp\POL 186 22-06-2020.exe
  "{path}"
  2⤵
  PID:744
- C:\Users\Admin\AppData\Local\Temp\POL 186 22-06-2020.exe
  "{path}"
  2⤵
  PID:388
- C:\Users\Admin\AppData\Local\Temp\POL 186 22-06-2020.exe
  "{path}"
  2⤵
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\POL 186 22-06-2020.exe
  "{path}"
  2⤵
  PID:1656
- C:\Users\Admin\AppData\Local\Temp\POL 186 22-06-2020.exe
  "{path}"
  2⤵
  PID:1052