Analysis
- max time kernel
14s - max time network
64s - platform
windows10_x64 - resource
win10v20201028 - submitted
01/04/2021, 05:57
General
- Target covid.exe
- Size 5.0MB
- Sample210401-w63nn4ppls
- SHA256 9d0cc73772d79a0561d03db4e6aca9fad9b125afbbc7f2b4f7f3df25eeed56a0
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\covid.exe"C:\Users\Admin\AppData\Local\Temp\covid.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\windowspowershell\v1.0\powershell.exe"C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -sta -noprofile -executionpolicy bypass -encodedcommand JAB4AD0AJwBiADgAOQBkADkAYwA0ADkALQA2ADUANQAxAC0ANAA2ADkANQAtAGEAMgBkAGEALQAxADIAMwA3AGIANQBhADkAZQA0AGUAZAAnADsAJAB5AD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAbwB2AGkAZAAuAGUAeABlACcAOwB0AHIAeQAgAHsADQAKACAAIABpAGYAIAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AFYAZQByAHMAaQBvAG4ALgBNAGEAagBvAHIAIAAtAGcAZQAgADQAKQANAAoAIAAgAHsAIAAkAG4AdQBsAGwAIAA9ACAAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AFUAbgBzAGEAZgBlAEwAbwBhAGQARgByAG8AbQAoACQAeQApACAAfQAgAGUAbABzAGUAIAB7ACAAJABuAHUAbABsACAAPQAgAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkAEYAaQBsAGUAKAAkAHkAKQB9AA0ACgAgACAALgAgACgAWwBfADMAMgAuAF8AOAA4AF0AOgA6AF8ANwA0ACgAJAB4ACkAKQANAAoAIAAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFAA0ACgB9ACAADQAKAGMAYQB0AGMAaAAgAFsATgBvAHQAUwB1AHAAcABvAHIAdABlAGQARQB4AGMAZQBwAHQAaQBvAG4AXQANAAoAewANAAoAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAnAEEAcABwAGwAaQBjAGEAdABpAG8AbgAgAGwAbwBjAGEAdABpAG8AbgAgAGkAcwAgAHUAbgB0AHIAdQBzAHQAZQBkAC4AIABDAG8AcAB5ACAAZgBpAGwAZQAgAHQAbwAgAGEAIABsAG8AYwBhAGwAIABkAHIAaQB2AGUALAAgAGEAbgBkACAAdAByAHkAIABhAGcAYQBpAG4ALgAnACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFIAZQBkAA0ACgB9AA0ACgBjAGEAdABjAGgAIAB7AA0ACgAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACgAIgBFAHIAcgBvAHIAOgAgACIAIAArACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIAAtAEYAbwByAGUAIABSAGUAZAAgAA0ACgB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1456-2-0x00007FFB59970000-0x00007FFB5A35C000-memory.dmp
memory/1456-3-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/3736-6-0x00007FFB59970000-0x00007FFB5A35C000-memory.dmp
memory/3736-7-0x0000016DF0A10000-0x0000016DF0A11000-memory.dmp
memory/3736-8-0x0000016DF0CC0000-0x0000016DF0CC1000-memory.dmp
memory/3736-9-0x0000016DF15A0000-0x0000016DF15A1000-memory.dmp
memory/3736-11-0x0000016DEE8E0000-0x0000016DEE8E2000-memory.dmp
memory/3736-12-0x0000016DEE8E3000-0x0000016DEE8E5000-memory.dmp
memory/3736-13-0x0000016DEE8E6000-0x0000016DEE8E8000-memory.dmp