Analysis
- max time kernel
5s - max time network
113s - platform
windows10_x64 - resource
win10 - submitted
16/09/2020, 13:40
General
- Target _-__----_-.exe
- Size 14KB
- Sample200916-v4t72kl962
- SHA256 66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955
Score
8/10
Malware Config
Signatures
- Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_-__----_-.exe"C:\Users\Admin\AppData\Local\Temp\_-__----_-.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2728-0-0x0000000073B10000-0x00000000741FE000-memory.dmp
memory/2728-1-0x0000000000630000-0x0000000000631000-memory.dmp
memory/2728-3-0x0000000005440000-0x0000000005441000-memory.dmp
memory/2728-4-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/2728-5-0x0000000002920000-0x0000000002921000-memory.dmp