a3fa345d4d272ddb13e0e3141bf18eac8521acaf8eb2eff8d3395f056740c2bd

Analysis

max time kernel
122s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
05/02/2021, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d4a217b376391725efa48b7669a489d.exe
Size 1.1MB
Sample210205-cf1cz2hpfx
SHA256 a3fa345d4d272ddb13e0e3141bf18eac8521acaf8eb2eff8d3395f056740c2bd
MD5 5d4a217b376391725efa48b7669a489d
SHA1 1696db3ccfbb455b4c7072c6c30f18fa2b7032af
SHA512 e56b9eb32ef7676050cc4a81e255ff36cb3a9f5d03d5877dbd286727069f5e6a1a288f6097e1fed145b50cb57c49e070fa1ee96581b22e3f4541b658497e3b2c
MD5 SHA1 SHA512

Score

5^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1172	RegSvcs.exe
1172	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3524	4048	5d4a217b376391725efa48b7669a489d.exe	78
PID 4048 wrote to memory of 3524	4048	5d4a217b376391725efa48b7669a489d.exe	78
PID 4048 wrote to memory of 3524	4048	5d4a217b376391725efa48b7669a489d.exe	78
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80
PID 4048 wrote to memory of 1172	4048	5d4a217b376391725efa48b7669a489d.exe	80

C:\Users\Admin\AppData\Local\Temp\5d4a217b376391725efa48b7669a489d.exe
"C:\Users\Admin\AppData\Local\Temp\5d4a217b376391725efa48b7669a489d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeZRqdecWtWfas" /XML "C:\Users\Admin\AppData\Local\Temp\tmp30C5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-24-0x0000000006080000-0x0000000006081000-memory.dmp

Download

memory/1172-23-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Download

memory/1172-21-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/1172-17-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/1172-15-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4048-7-0x0000000005450000-0x0000000005451000-memory.dmp

Download

memory/4048-12-0x0000000001340000-0x00000000013A4000-memory.dmp

Download

memory/4048-11-0x0000000005600000-0x0000000005604000-memory.dmp

Download

memory/4048-10-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/4048-9-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download

memory/4048-8-0x0000000005670000-0x0000000005671000-memory.dmp

Download

memory/4048-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/4048-6-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download

memory/4048-5-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/4048-3-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download