e1520adc5a4b52323127c67437519ad9c1becf7c0a6834ef9e4a4b734345f381 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows10_x64
resource
win10
submitted
26/07/2020, 19:23

Sharing

Report Analysis Logs

General

Target

Random.RANSOM.bin.exe
Size

64KB
MD5

bc234901a4e7dd764b97105a4f6840b9
SHA1

9930e609f8a0b4c999e52799f6267e86b66f7188
SHA256

d2178841fa9e74c19c7d19da870c5beb0dd30cb36b70dd6a2e3488416cab9980
SHA512

9285bbd6e19fd4488a371e54b9bd460207cc29670ada23dc445a352c912edf78536196398bbc49fada73ef2884eb5125dad928ac1a96ba64a46c80904ecf0a4c

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3340	2460	Random.RANSOM.bin.exe	68
PID 2460 wrote to memory of 3340	2460	Random.RANSOM.bin.exe	68

Executes dropped EXE 1 IoCs

pid	Process
3340	svchost.exe

Deletes itself 1 IoCs

pid	Process
3340	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3340	svchost.exe
Token: SeDebugPrivilege	3340	svchost.exe
Token: SeDebugPrivilege	3340	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Random.RANSOM.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Random.RANSOM.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\Appdata\svchost.exe
  "C:\Users\Admin\Appdata\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Suspicious use of AdjustPrivilegeToken
  PID:3340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads