Analysis

  • max time kernel
    59s
  • max time network
    67s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-02-2021 11:30

General

  • Target

    updatewin1.exe

  • Size

    272KB

  • MD5

    5b4bd24d6240f467bfbc74803c9f15b0

  • SHA1

    c17f98c182d299845c54069872e8137645768a1a

  • SHA256

    14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e

  • SHA512

    a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc

Score
10/10

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Disables Task Manager via registry modification
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\updatewin1.exe
    "C:\Users\Admin\AppData\Local\Temp\updatewin1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Temp\updatewin1.exe
      "C:\Users\Admin\AppData\Local\Temp\updatewin1.exe" --Admin
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3480
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps1
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4048
      • C:\Program Files\Windows Defender\mpcmdrun.exe
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all
        3⤵
        • Deletes Windows Defender Definitions
        PID:3096
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
        3⤵
          PID:3720

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1152-2-0x0000000002370000-0x0000000002371000-memory.dmp

      Filesize

      4KB

    • memory/1152-4-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/1944-5-0x0000000002000000-0x0000000002001000-memory.dmp

      Filesize

      4KB

    • memory/2524-68-0x0000000006DD3000-0x0000000006DD4000-memory.dmp

      Filesize

      4KB

    • memory/2524-53-0x0000000009A00000-0x0000000009A01000-memory.dmp

      Filesize

      4KB

    • memory/2524-52-0x00000000091A0000-0x00000000091A1000-memory.dmp

      Filesize

      4KB

    • memory/2524-47-0x0000000006DD2000-0x0000000006DD3000-memory.dmp

      Filesize

      4KB

    • memory/2524-46-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

      Filesize

      4KB

    • memory/2524-36-0x0000000073410000-0x0000000073AFE000-memory.dmp

      Filesize

      6.9MB

    • memory/3480-15-0x0000000007E40000-0x0000000007E41000-memory.dmp

      Filesize

      4KB

    • memory/3480-11-0x0000000007590000-0x0000000007591000-memory.dmp

      Filesize

      4KB

    • memory/3480-29-0x0000000009630000-0x0000000009631000-memory.dmp

      Filesize

      4KB

    • memory/3480-30-0x00000000097F0000-0x00000000097F1000-memory.dmp

      Filesize

      4KB

    • memory/3480-32-0x0000000009790000-0x0000000009791000-memory.dmp

      Filesize

      4KB

    • memory/3480-33-0x0000000004EA3000-0x0000000004EA4000-memory.dmp

      Filesize

      4KB

    • memory/3480-31-0x000000007EDD0000-0x000000007EDD1000-memory.dmp

      Filesize

      4KB

    • memory/3480-21-0x00000000094F0000-0x0000000009523000-memory.dmp

      Filesize

      204KB

    • memory/3480-19-0x0000000008560000-0x0000000008561000-memory.dmp

      Filesize

      4KB

    • memory/3480-18-0x0000000008740000-0x0000000008741000-memory.dmp

      Filesize

      4KB

    • memory/3480-17-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

      Filesize

      4KB

    • memory/3480-45-0x0000000004EA6000-0x0000000004EA8000-memory.dmp

      Filesize

      8KB

    • memory/3480-16-0x0000000004EA2000-0x0000000004EA3000-memory.dmp

      Filesize

      4KB

    • memory/3480-14-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

      Filesize

      4KB

    • memory/3480-13-0x0000000007C30000-0x0000000007C31000-memory.dmp

      Filesize

      4KB

    • memory/3480-12-0x0000000007390000-0x0000000007391000-memory.dmp

      Filesize

      4KB

    • memory/3480-28-0x00000000094D0000-0x00000000094D1000-memory.dmp

      Filesize

      4KB

    • memory/3480-7-0x0000000073410000-0x0000000073AFE000-memory.dmp

      Filesize

      6.9MB

    • memory/3480-8-0x0000000004D70000-0x0000000004D71000-memory.dmp

      Filesize

      4KB

    • memory/3480-10-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

      Filesize

      4KB

    • memory/4048-64-0x0000000007930000-0x0000000007931000-memory.dmp

      Filesize

      4KB

    • memory/4048-57-0x0000000072A60000-0x000000007314E000-memory.dmp

      Filesize

      6.9MB

    • memory/4048-69-0x0000000006B10000-0x0000000006B11000-memory.dmp

      Filesize

      4KB

    • memory/4048-67-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

      Filesize

      4KB

    • memory/4048-70-0x0000000006B12000-0x0000000006B13000-memory.dmp

      Filesize

      4KB

    • memory/4048-83-0x0000000009030000-0x0000000009031000-memory.dmp

      Filesize

      4KB

    • memory/4048-82-0x000000007EE40000-0x000000007EE41000-memory.dmp

      Filesize

      4KB

    • memory/4048-85-0x0000000006B13000-0x0000000006B14000-memory.dmp

      Filesize

      4KB

    • memory/4048-86-0x00000000092A0000-0x00000000092A1000-memory.dmp

      Filesize

      4KB

    • memory/4048-88-0x0000000009280000-0x0000000009281000-memory.dmp

      Filesize

      4KB