137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93

General

Target
137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
Size 551KB
Sample201110-rd33nc7cd6
SHA256 137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93
MD5 837d5e0e15b2d9c30dfa1745acfa17dc
SHA1 ed6c05e682bea4b1f7e92847c2b0b7ca3851a499
SHA512 e2046be94fc9459b67e2d73ba6acb656a498c350f727f08364d38e16a421971d3eb85dcf9766820c2818be339b6ccd211faed3aa50ec2722a1b4219c269dd4ab
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1332	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	29
PID 288 wrote to memory of 1332	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	29
PID 288 wrote to memory of 1332	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	29
PID 288 wrote to memory of 1332	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	29
PID 288 wrote to memory of 1496	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	31
PID 288 wrote to memory of 1496	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	31
PID 288 wrote to memory of 1496	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	31
PID 288 wrote to memory of 1496	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	31
PID 288 wrote to memory of 316	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	32
PID 288 wrote to memory of 316	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	32
PID 288 wrote to memory of 316	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	32
PID 288 wrote to memory of 316	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	32
PID 288 wrote to memory of 1600	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	33
PID 288 wrote to memory of 1600	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	33
PID 288 wrote to memory of 1600	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	33
PID 288 wrote to memory of 1600	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	33
PID 288 wrote to memory of 1564	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	34
PID 288 wrote to memory of 1564	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	34
PID 288 wrote to memory of 1564	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	34
PID 288 wrote to memory of 1564	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	34
PID 288 wrote to memory of 744	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	35
PID 288 wrote to memory of 744	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	35
PID 288 wrote to memory of 744	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	35
PID 288 wrote to memory of 744	288	137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe	35

C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
"C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QwaFpW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
  "C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe"
  2⤵
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
  "C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe"
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
  "C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe"
  2⤵
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
  "C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe"
  2⤵
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe
  "C:\Users\Admin\AppData\Local\Temp\137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93.exe"
  2⤵
  PID:744