Analysis

  • max time kernel
    25s
  • max time network
    105s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-02-2021 10:17

General

  • Target

    updatewin1.exe

  • Size

    272KB

  • MD5

    5b4bd24d6240f467bfbc74803c9f15b0

  • SHA1

    c17f98c182d299845c54069872e8137645768a1a

  • SHA256

    14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e

  • SHA512

    a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc

Score
10/10

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Disables Task Manager via registry modification
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\updatewin1.exe
    "C:\Users\Admin\AppData\Local\Temp\updatewin1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\updatewin1.exe
      "C:\Users\Admin\AppData\Local\Temp\updatewin1.exe" --Admin
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:520
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps1
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3488
      • C:\Program Files\Windows Defender\mpcmdrun.exe
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all
        3⤵
        • Deletes Windows Defender Definitions
        PID:3544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
        3⤵
          PID:4496

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/520-15-0x00000000049F2000-0x00000000049F3000-memory.dmp

      Filesize

      4KB

    • memory/520-19-0x0000000008110000-0x0000000008111000-memory.dmp

      Filesize

      4KB

    • memory/520-10-0x0000000007070000-0x0000000007071000-memory.dmp

      Filesize

      4KB

    • memory/520-11-0x00000000076D0000-0x00000000076D1000-memory.dmp

      Filesize

      4KB

    • memory/520-12-0x0000000007850000-0x0000000007851000-memory.dmp

      Filesize

      4KB

    • memory/520-13-0x00000000079C0000-0x00000000079C1000-memory.dmp

      Filesize

      4KB

    • memory/520-14-0x00000000049F0000-0x00000000049F1000-memory.dmp

      Filesize

      4KB

    • memory/520-38-0x00000000049F3000-0x00000000049F4000-memory.dmp

      Filesize

      4KB

    • memory/520-16-0x0000000007AE0000-0x0000000007AE1000-memory.dmp

      Filesize

      4KB

    • memory/520-17-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

      Filesize

      4KB

    • memory/520-18-0x00000000081B0000-0x00000000081B1000-memory.dmp

      Filesize

      4KB

    • memory/520-9-0x0000000004970000-0x0000000004971000-memory.dmp

      Filesize

      4KB

    • memory/520-21-0x0000000008EF0000-0x0000000008F23000-memory.dmp

      Filesize

      204KB

    • memory/520-28-0x0000000008ED0000-0x0000000008ED1000-memory.dmp

      Filesize

      4KB

    • memory/520-29-0x0000000009230000-0x0000000009231000-memory.dmp

      Filesize

      4KB

    • memory/520-30-0x000000007F550000-0x000000007F551000-memory.dmp

      Filesize

      4KB

    • memory/520-31-0x00000000093F0000-0x00000000093F1000-memory.dmp

      Filesize

      4KB

    • memory/520-32-0x0000000009390000-0x0000000009391000-memory.dmp

      Filesize

      4KB

    • memory/520-7-0x0000000073150000-0x000000007383E000-memory.dmp

      Filesize

      6.9MB

    • memory/520-39-0x00000000049F6000-0x00000000049F8000-memory.dmp

      Filesize

      8KB

    • memory/1680-68-0x0000000004913000-0x0000000004914000-memory.dmp

      Filesize

      4KB

    • memory/1680-40-0x0000000004910000-0x0000000004911000-memory.dmp

      Filesize

      4KB

    • memory/1680-41-0x0000000004912000-0x0000000004913000-memory.dmp

      Filesize

      4KB

    • memory/1680-35-0x0000000073150000-0x000000007383E000-memory.dmp

      Filesize

      6.9MB

    • memory/1680-52-0x0000000009040000-0x0000000009041000-memory.dmp

      Filesize

      4KB

    • memory/1680-53-0x0000000009680000-0x0000000009681000-memory.dmp

      Filesize

      4KB

    • memory/3488-69-0x0000000007100000-0x0000000007101000-memory.dmp

      Filesize

      4KB

    • memory/3488-83-0x000000007EA30000-0x000000007EA31000-memory.dmp

      Filesize

      4KB

    • memory/3488-88-0x00000000098D0000-0x00000000098D1000-memory.dmp

      Filesize

      4KB

    • memory/3488-57-0x0000000072850000-0x0000000072F3E000-memory.dmp

      Filesize

      6.9MB

    • memory/3488-86-0x00000000098F0000-0x00000000098F1000-memory.dmp

      Filesize

      4KB

    • memory/3488-64-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

      Filesize

      4KB

    • memory/3488-85-0x0000000007103000-0x0000000007104000-memory.dmp

      Filesize

      4KB

    • memory/3488-67-0x0000000008870000-0x0000000008871000-memory.dmp

      Filesize

      4KB

    • memory/3488-82-0x0000000009680000-0x0000000009681000-memory.dmp

      Filesize

      4KB

    • memory/3488-70-0x0000000007102000-0x0000000007103000-memory.dmp

      Filesize

      4KB

    • memory/4216-4-0x0000000002290000-0x0000000002291000-memory.dmp

      Filesize

      4KB

    • memory/4764-2-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

    • memory/4764-5-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB