3e48d983e3315501931c646f896a8189637f5b9d21c453b051cd17f2584ee3c4

Analysis

max time kernel
151s
max time network
152s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B6LNCKjOGt5EmFQ.exe
Size

1.8MB
MD5

80d255a6a5ec339e15d6fec3c0fef666
SHA1

bca665ff5a6a7084df2d424c0ed7fff3e141acbc
SHA256

3e48d983e3315501931c646f896a8189637f5b9d21c453b051cd17f2584ee3c4
SHA512

1bf61d60fc6646ff63786da850b4118fb15dcc6f2c831a8a80d58225cf55bfef395d69473afeae9d05f97c3adcedd90100c4266bc1d537b7f6d7f933cb6291c4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

864 schtasks.exe

pid	process
864	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

B6LNCKjOGt5EmFQ.exe

description	pid	process	target process
PID 1036 wrote to memory of 864	1036	B6LNCKjOGt5EmFQ.exe	schtasks.exe
PID 1036 wrote to memory of 864	1036	B6LNCKjOGt5EmFQ.exe	schtasks.exe
PID 1036 wrote to memory of 864	1036	B6LNCKjOGt5EmFQ.exe	schtasks.exe
PID 1036 wrote to memory of 864	1036	B6LNCKjOGt5EmFQ.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\B6LNCKjOGt5EmFQ.exe
"C:\Users\Admin\AppData\Local\Temp\B6LNCKjOGt5EmFQ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcVfsyyjYuQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F83.tmp"
2⤵
- Creates scheduled task(s)
PID:864

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8F83.tmp
MD5
b51dc0507e92525f420ab969e2c758d7

SHA1
8efb2dd6470d3aad5133f53ebb7a25ab5df84fc5

SHA256
aa8d4f28eb2f4952172cf47c012bd8d37639ba652f7e49c9dce72337a950aad2

SHA512
b2b40ac1cd203fe99c02d26ec2d700411bdccf72b13287cab9ac57b2dcf5c2547dec0eb80b8d1bad8b3eef32c8d12c9c32664436d741c251db2356a949667734

Download Submit
memory/864-7-0x0000000000000000-mapping.dmp

Download
memory/1036-2-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1036-3-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1036-5-0x0000000000430000-0x000000000043E000-memory.dmp

Filesize
56KB

Download
memory/1036-6-0x0000000005D10000-0x0000000005ED2000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads