Overview

overview

3

Static

static

SecuriteIn...03.exe

windows7_x64

3

SecuriteIn...03.exe

windows10_x64

3

Analysis

  • max time kernel
    13s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    07/03/2021, 23:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Trojan.Win32.Save.a.10691.28703.exe
  • Size 821KB
  • Sample210307-a9y957hmwe
  • SHA256 bf81bf5e34c04aed363d975f7d3c8af217349011ee1083d3f50b71de885b4847
  • MD5 SHA1 SHA512
Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.10691.28703.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.10691.28703.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.10691.28703.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.10691.28703.exe" 1
      2⤵
        PID:4024

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/812-2-0x00007FFB85320000-0x00007FFB85CC0000-memory.dmp
          Download

          memory/812-3-0x0000000002550000-0x0000000002552000-memory.dmp
          Download

          memory/4024-7-0x0000000002AB0000-0x0000000002AB2000-memory.dmp
          Download

          memory/4024-6-0x00007FFB85320000-0x00007FFB85CC0000-memory.dmp
          Download