Analysis
- max time kernel
6s - max time network
13s - platform
windows7_x64 - resource
win7v20201028 - submitted
01/04/2021, 05:57
General
- Target covid.exe
- Size 5.0MB
- Sample210401-w63nn4ppls
- SHA256 9d0cc73772d79a0561d03db4e6aca9fad9b125afbbc7f2b4f7f3df25eeed56a0
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\covid.exe"C:\Users\Admin\AppData\Local\Temp\covid.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\windowspowershell\v1.0\powershell.exe"C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -sta -noprofile -executionpolicy bypass -encodedcommand JAB4AD0AJwBlAGMAMAAyADAANgBmADEALQA1AGMAYgBkAC0ANABmADIAZAAtAGEAOABmADIALQAwAGIAYgA2ADYAYwA2ADkAZgBhADAAOAAnADsAJAB5AD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAbwB2AGkAZAAuAGUAeABlACcAOwB0AHIAeQAgAHsADQAKACAAIABpAGYAIAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AFYAZQByAHMAaQBvAG4ALgBNAGEAagBvAHIAIAAtAGcAZQAgADQAKQANAAoAIAAgAHsAIAAkAG4AdQBsAGwAIAA9ACAAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AFUAbgBzAGEAZgBlAEwAbwBhAGQARgByAG8AbQAoACQAeQApACAAfQAgAGUAbABzAGUAIAB7ACAAJABuAHUAbABsACAAPQAgAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkAEYAaQBsAGUAKAAkAHkAKQB9AA0ACgAgACAALgAgACgAWwBfADMAMgAuAF8AOAA4AF0AOgA6AF8ANwA0ACgAJAB4ACkAKQANAAoAIAAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFAA0ACgB9ACAADQAKAGMAYQB0AGMAaAAgAFsATgBvAHQAUwB1AHAAcABvAHIAdABlAGQARQB4AGMAZQBwAHQAaQBvAG4AXQANAAoAewANAAoAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAnAEEAcABwAGwAaQBjAGEAdABpAG8AbgAgAGwAbwBjAGEAdABpAG8AbgAgAGkAcwAgAHUAbgB0AHIAdQBzAHQAZQBkAC4AIABDAG8AcAB5ACAAZgBpAGwAZQAgAHQAbwAgAGEAIABsAG8AYwBhAGwAIABkAHIAaQB2AGUALAAgAGEAbgBkACAAdAByAHkAIABhAGcAYQBpAG4ALgAnACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFIAZQBkAA0ACgB9AA0ACgBjAGEAdABjAGgAIAB7AA0ACgAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACgAIgBFAHIAcgBvAHIAOgAgACIAIAArACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIAAtAEYAbwByAGUAIABSAGUAZAAgAA0ACgB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1576-2-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp
memory/1576-3-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/1924-6-0x000007FEFC101000-0x000007FEFC103000-memory.dmp
memory/1924-7-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp
memory/1924-9-0x000000001ACC0000-0x000000001ACC1000-memory.dmp
memory/1924-8-0x0000000002390000-0x0000000002391000-memory.dmp
memory/1924-10-0x000000001AC40000-0x000000001AC42000-memory.dmp
memory/1924-11-0x000000001AC44000-0x000000001AC46000-memory.dmp
memory/1924-12-0x00000000025E0000-0x00000000025E1000-memory.dmp
memory/1924-13-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/1924-14-0x000000001CA90000-0x000000001CA91000-memory.dmp
memory/1924-16-0x000000001ABB0000-0x000000001ABB1000-memory.dmp
memory/1924-17-0x000000001C580000-0x000000001C581000-memory.dmp