Analysis
-
max time kernel
59s -
max time network
67s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-02-2021 11:30
Static task
static1
Behavioral task
behavioral1
Sample
updatewin1.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
updatewin1.exe
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
updatewin1.exe
-
Size
272KB
-
MD5
5b4bd24d6240f467bfbc74803c9f15b0
-
SHA1
c17f98c182d299845c54069872e8137645768a1a
-
SHA256
14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e
-
SHA512
a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc
Score
10/10
Malware Config
Signatures
-
Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
pid Process 3096 mpcmdrun.exe -
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3480 powershell.exe 3480 powershell.exe 3480 powershell.exe 3480 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 4048 powershell.exe 4048 powershell.exe 4048 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3480 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeDebugPrivilege 4048 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1944 1152 updatewin1.exe 78 PID 1152 wrote to memory of 1944 1152 updatewin1.exe 78 PID 1152 wrote to memory of 1944 1152 updatewin1.exe 78 PID 1944 wrote to memory of 3480 1944 updatewin1.exe 80 PID 1944 wrote to memory of 3480 1944 updatewin1.exe 80 PID 1944 wrote to memory of 3480 1944 updatewin1.exe 80 PID 1944 wrote to memory of 2524 1944 updatewin1.exe 83 PID 1944 wrote to memory of 2524 1944 updatewin1.exe 83 PID 1944 wrote to memory of 2524 1944 updatewin1.exe 83 PID 2524 wrote to memory of 4048 2524 powershell.exe 85 PID 2524 wrote to memory of 4048 2524 powershell.exe 85 PID 2524 wrote to memory of 4048 2524 powershell.exe 85 PID 1944 wrote to memory of 3096 1944 updatewin1.exe 87 PID 1944 wrote to memory of 3096 1944 updatewin1.exe 87 PID 1944 wrote to memory of 3720 1944 updatewin1.exe 89 PID 1944 wrote to memory of 3720 1944 updatewin1.exe 89 PID 1944 wrote to memory of 3720 1944 updatewin1.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\updatewin1.exe"C:\Users\Admin\AppData\Local\Temp\updatewin1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\updatewin1.exe"C:\Users\Admin\AppData\Local\Temp\updatewin1.exe" --Admin2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps14⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all3⤵
- Deletes Windows Defender Definitions
PID:3096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""3⤵PID:3720
-
-