Analysis
- max time kernel
60s - max time network
119s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/02/2021, 07:14
General
- Target 소개 편지_0001-Letter of Intro_.exe
- Size 547KB
- Sample210204-kthny7f556
- SHA256 fb00b6b2b4926cf293cce405408643b5cddbd8b21ec8cba9dbd6b44a1d34231d
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\소개 편지_0001-Letter of Intro_.exe"C:\Users\Admin\AppData\Local\Temp\소개 편지_0001-Letter of Intro_.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vQfQqIAjTU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1EB4.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 16242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/756-8-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/756-5-0x00000000052A0000-0x00000000052A1000-memory.dmp
memory/756-6-0x0000000005840000-0x0000000005841000-memory.dmp
memory/756-7-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/756-9-0x0000000005280000-0x0000000005281000-memory.dmp
memory/756-2-0x00000000739A0000-0x000000007408E000-memory.dmp
memory/756-10-0x0000000005540000-0x0000000005541000-memory.dmp
memory/756-11-0x00000000055B0000-0x00000000055B4000-memory.dmp
memory/756-12-0x0000000006010000-0x000000000605B000-memory.dmp
memory/756-3-0x00000000009F0000-0x00000000009F1000-memory.dmp
memory/3892-15-0x0000000004750000-0x0000000004751000-memory.dmp