Analysis

  • max time kernel
    126s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    06-04-2021 08:19

General

  • Target

    IMAGE20210406_490133692.exe

  • Size

    1.6MB

  • MD5

    432494553bb7b05ce1970f180968aac3

  • SHA1

    c1147f87babcf9c0ce3e278ded158c1343dc7e92

  • SHA256

    ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b

  • SHA512

    bf961ad8680d045a9a2555018695ed2e0a607feda2b60a3936be19f380985742075349d3d9112a8894f5a0c0fef2c9c668e5469ca4005ca7109bf8925b5067fd

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
    "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2400
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4064
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nTLvOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8F7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2056
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2764
    • C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
      "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
      2⤵
        PID:3988
      • C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
        "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:184

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/184-36-0x0000000000400000-0x00000000004F3000-memory.dmp

      Filesize

      972KB

    • memory/184-45-0x0000000000400000-0x00000000004F3000-memory.dmp

      Filesize

      972KB

    • memory/2400-50-0x0000000007E70000-0x0000000007E71000-memory.dmp

      Filesize

      4KB

    • memory/2400-19-0x0000000073A20000-0x000000007410E000-memory.dmp

      Filesize

      6.9MB

    • memory/2400-79-0x00000000096A0000-0x00000000096A1000-memory.dmp

      Filesize

      4KB

    • memory/2400-83-0x0000000009810000-0x0000000009811000-memory.dmp

      Filesize

      4KB

    • memory/2400-41-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

      Filesize

      4KB

    • memory/2400-78-0x000000007EA70000-0x000000007EA71000-memory.dmp

      Filesize

      4KB

    • memory/2400-52-0x0000000008760000-0x0000000008761000-memory.dmp

      Filesize

      4KB

    • memory/2400-92-0x00000000099E0000-0x00000000099E1000-memory.dmp

      Filesize

      4KB

    • memory/2400-20-0x0000000004C30000-0x0000000004C31000-memory.dmp

      Filesize

      4KB

    • memory/2400-22-0x00000000076C0000-0x00000000076C1000-memory.dmp

      Filesize

      4KB

    • memory/2400-24-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

      Filesize

      4KB

    • memory/2400-95-0x0000000004BF3000-0x0000000004BF4000-memory.dmp

      Filesize

      4KB

    • memory/2400-26-0x0000000004BF2000-0x0000000004BF3000-memory.dmp

      Filesize

      4KB

    • memory/2764-77-0x000000007F6A0000-0x000000007F6A1000-memory.dmp

      Filesize

      4KB

    • memory/2764-38-0x0000000073A20000-0x000000007410E000-memory.dmp

      Filesize

      6.9MB

    • memory/2764-98-0x0000000009450000-0x0000000009451000-memory.dmp

      Filesize

      4KB

    • memory/2764-96-0x0000000006B53000-0x0000000006B54000-memory.dmp

      Filesize

      4KB

    • memory/2764-61-0x0000000008FA0000-0x0000000008FD3000-memory.dmp

      Filesize

      204KB

    • memory/2764-44-0x0000000006B52000-0x0000000006B53000-memory.dmp

      Filesize

      4KB

    • memory/2764-43-0x0000000006B50000-0x0000000006B51000-memory.dmp

      Filesize

      4KB

    • memory/3888-8-0x0000000004D30000-0x0000000004D31000-memory.dmp

      Filesize

      4KB

    • memory/3888-11-0x0000000005140000-0x0000000005144000-memory.dmp

      Filesize

      16KB

    • memory/3888-3-0x0000000000390000-0x0000000000391000-memory.dmp

      Filesize

      4KB

    • memory/3888-5-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

      Filesize

      4KB

    • memory/3888-14-0x0000000008210000-0x000000000830A000-memory.dmp

      Filesize

      1000KB

    • memory/3888-13-0x0000000005C50000-0x0000000005D49000-memory.dmp

      Filesize

      996KB

    • memory/3888-12-0x000000007E7B0000-0x000000007E7B1000-memory.dmp

      Filesize

      4KB

    • memory/3888-6-0x0000000005350000-0x0000000005351000-memory.dmp

      Filesize

      4KB

    • memory/3888-7-0x0000000004E50000-0x0000000004E51000-memory.dmp

      Filesize

      4KB

    • memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmp

      Filesize

      6.9MB

    • memory/3888-9-0x0000000005010000-0x0000000005011000-memory.dmp

      Filesize

      4KB

    • memory/3888-10-0x0000000005020000-0x0000000005021000-memory.dmp

      Filesize

      4KB

    • memory/4064-82-0x000000007F130000-0x000000007F131000-memory.dmp

      Filesize

      4KB

    • memory/4064-27-0x00000000045F2000-0x00000000045F3000-memory.dmp

      Filesize

      4KB

    • memory/4064-34-0x00000000077A0000-0x00000000077A1000-memory.dmp

      Filesize

      4KB

    • memory/4064-97-0x00000000045F3000-0x00000000045F4000-memory.dmp

      Filesize

      4KB

    • memory/4064-31-0x0000000007820000-0x0000000007821000-memory.dmp

      Filesize

      4KB

    • memory/4064-29-0x0000000006F60000-0x0000000006F61000-memory.dmp

      Filesize

      4KB

    • memory/4064-102-0x0000000009280000-0x0000000009281000-memory.dmp

      Filesize

      4KB

    • memory/4064-56-0x0000000008140000-0x0000000008141000-memory.dmp

      Filesize

      4KB

    • memory/4064-25-0x00000000045F0000-0x00000000045F1000-memory.dmp

      Filesize

      4KB

    • memory/4064-18-0x0000000073A20000-0x000000007410E000-memory.dmp

      Filesize

      6.9MB