ee2d4fc12ea7c99a8e94f0222cdeb5f10c36c1ca797bd9eb0dc80e8d8efed315

General

Target
AWB-Nummer 6008824216.JPG.exe
Size 664KB
Sample210226-kc9b2k243a
SHA256 ee2d4fc12ea7c99a8e94f0222cdeb5f10c36c1ca797bd9eb0dc80e8d8efed315
MD5 4d345f3799d744a08c6759d171852791
SHA1 0c092dea914b85d635494f616d0efd8ddb00a491
SHA512 91b90bd3513543e00905eb350f8e013ccee7a0cbe9dc9153ee175a47b33e7e50b800acc8d57c4a9351efccac9c01f5bed55268051edb74d3f7fa0974f2da1397
MD5 SHA1 SHA512

Score

7^/10

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	AWB-Nummer 6008824216.JPG.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3752	648	AWB-Nummer 6008824216.JPG.exe	78
PID 648 wrote to memory of 3752	648	AWB-Nummer 6008824216.JPG.exe	78
PID 648 wrote to memory of 3752	648	AWB-Nummer 6008824216.JPG.exe	78
PID 648 wrote to memory of 1344	648	AWB-Nummer 6008824216.JPG.exe	80
PID 648 wrote to memory of 1344	648	AWB-Nummer 6008824216.JPG.exe	80
PID 648 wrote to memory of 1344	648	AWB-Nummer 6008824216.JPG.exe	80
PID 648 wrote to memory of 1152	648	AWB-Nummer 6008824216.JPG.exe	81
PID 648 wrote to memory of 1152	648	AWB-Nummer 6008824216.JPG.exe	81
PID 648 wrote to memory of 1152	648	AWB-Nummer 6008824216.JPG.exe	81
PID 648 wrote to memory of 1516	648	AWB-Nummer 6008824216.JPG.exe	82
PID 648 wrote to memory of 1516	648	AWB-Nummer 6008824216.JPG.exe	82
PID 648 wrote to memory of 1516	648	AWB-Nummer 6008824216.JPG.exe	82
PID 648 wrote to memory of 3700	648	AWB-Nummer 6008824216.JPG.exe	83
PID 648 wrote to memory of 3700	648	AWB-Nummer 6008824216.JPG.exe	83
PID 648 wrote to memory of 3700	648	AWB-Nummer 6008824216.JPG.exe	83
PID 648 wrote to memory of 2112	648	AWB-Nummer 6008824216.JPG.exe	84
PID 648 wrote to memory of 2112	648	AWB-Nummer 6008824216.JPG.exe	84
PID 648 wrote to memory of 2112	648	AWB-Nummer 6008824216.JPG.exe	84

C:\Users\Admin\AppData\Local\Temp\AWB-Nummer 6008824216.JPG.exe
"C:\Users\Admin\AppData\Local\Temp\AWB-Nummer 6008824216.JPG.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZRsepfiKAFuoje" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFA44.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "{path}"
  2⤵
  PID:1344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "{path}"
  2⤵
  PID:1152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "{path}"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "{path}"
  2⤵
  PID:3700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "{path}"
  2⤵
  PID:2112