889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593

Analysis

max time kernel
93s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
29/01/2021, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe
Size 333KB
Sample210129-5fpw68f2mj
SHA256 889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593
MD5 72c7f9f0886eec4933df3746d9586806
SHA1 28b2bd06776d1b0e496d7e062d6cd0cdc0d535c0
SHA512 45bc58608378862deed6ac0024cf0f153cb04d6eee5769c12dc63cb6e35b0bd79d4412eba73497d58d8c3e99b33b400a75ed14e2ea4dc3d4ebd166e6925c804a
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 580 created 3008	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	24

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe
580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe
580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe
580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78
PID 580 wrote to memory of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78
PID 580 wrote to memory of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78
PID 580 wrote to memory of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78
PID 580 wrote to memory of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78
PID 580 wrote to memory of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78
PID 580 wrote to memory of 3728	580	889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe	78

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3008
- C:\Users\Admin\AppData\Local\Temp\889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe
  "C:\Users\Admin\AppData\Local\Temp\889e728a55b58b3a124d38610a30ae07150f78ca900dbef4fc15120ea49ec593.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-2-0x0000000001E90000-0x0000000001EBD000-memory.dmp

Download

memory/580-3-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/580-4-0x0000000001EC0000-0x0000000001EE7000-memory.dmp

Download

memory/580-5-0x00000000001C0000-0x00000000001EA000-memory.dmp

Download

memory/3728-6-0x00007FF7576A0000-0x00007FF7576C4000-memory.dmp

Download