Analysis
- max time kernel
151s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe
- Size 658KB
- Sample201109-x96dr69vsn
- SHA256 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0
- MD5 8be33a14d056b3fa353ef25d992b6055
- SHA1 94eea24e843ca0920f5cf50c42070ede4f07fb00
- SHA512 30915b0e90814edcb7dec86653d1da1b512124c290736fe642ce87d7d18cf7f10175cf1c18e37b15948edc7b3eae0899e4e8a0964f7908a19c10d2d9df629ff5
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeSecurityPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeTakeOwnershipPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeLoadDriverPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeSystemProfilePrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeSystemtimePrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeProfSingleProcessPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeIncBasePriorityPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeCreatePagefilePrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeBackupPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeRestorePrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeShutdownPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeDebugPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeSystemEnvironmentPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeChangeNotifyPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeRemoteShutdownPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeUndockPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeManageVolumePrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeImpersonatePrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: SeCreateGlobalPrivilege 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: 33 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: 34 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: 35 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe Token: 36 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75 PID 504 wrote to memory of 2468 504 04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe"C:\Users\Admin\AppData\Local\Temp\04ecc8a39bb1236fb737256d4438f3781141a95d8d55576bd1a7e17a0c8b5aa0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵PID:2468
-