Analysis
-
max time kernel
126s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-04-2021 08:19
Static task
static1
Behavioral task
behavioral1
Sample
IMAGE20210406_490133692.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
IMAGE20210406_490133692.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
IMAGE20210406_490133692.exe
-
Size
1.6MB
-
MD5
432494553bb7b05ce1970f180968aac3
-
SHA1
c1147f87babcf9c0ce3e278ded158c1343dc7e92
-
SHA256
ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b
-
SHA512
bf961ad8680d045a9a2555018695ed2e0a607feda2b60a3936be19f380985742075349d3d9112a8894f5a0c0fef2c9c668e5469ca4005ca7109bf8925b5067fd
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3888 set thread context of 184 3888 IMAGE20210406_490133692.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2056 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 3888 IMAGE20210406_490133692.exe 3888 IMAGE20210406_490133692.exe 3888 IMAGE20210406_490133692.exe 4064 powershell.exe 2400 powershell.exe 3888 IMAGE20210406_490133692.exe 3888 IMAGE20210406_490133692.exe 3888 IMAGE20210406_490133692.exe 2764 powershell.exe 2400 powershell.exe 4064 powershell.exe 2764 powershell.exe 2400 powershell.exe 4064 powershell.exe 2764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3888 IMAGE20210406_490133692.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeDebugPrivilege 2400 powershell.exe Token: SeDebugPrivilege 2764 powershell.exe Token: SeShutdownPrivilege 184 IMAGE20210406_490133692.exe Token: SeCreatePagefilePrivilege 184 IMAGE20210406_490133692.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3888 wrote to memory of 2400 3888 IMAGE20210406_490133692.exe 79 PID 3888 wrote to memory of 2400 3888 IMAGE20210406_490133692.exe 79 PID 3888 wrote to memory of 2400 3888 IMAGE20210406_490133692.exe 79 PID 3888 wrote to memory of 4064 3888 IMAGE20210406_490133692.exe 81 PID 3888 wrote to memory of 4064 3888 IMAGE20210406_490133692.exe 81 PID 3888 wrote to memory of 4064 3888 IMAGE20210406_490133692.exe 81 PID 3888 wrote to memory of 2056 3888 IMAGE20210406_490133692.exe 83 PID 3888 wrote to memory of 2056 3888 IMAGE20210406_490133692.exe 83 PID 3888 wrote to memory of 2056 3888 IMAGE20210406_490133692.exe 83 PID 3888 wrote to memory of 2764 3888 IMAGE20210406_490133692.exe 85 PID 3888 wrote to memory of 2764 3888 IMAGE20210406_490133692.exe 85 PID 3888 wrote to memory of 2764 3888 IMAGE20210406_490133692.exe 85 PID 3888 wrote to memory of 3988 3888 IMAGE20210406_490133692.exe 86 PID 3888 wrote to memory of 3988 3888 IMAGE20210406_490133692.exe 86 PID 3888 wrote to memory of 3988 3888 IMAGE20210406_490133692.exe 86 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88 PID 3888 wrote to memory of 184 3888 IMAGE20210406_490133692.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nTLvOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8F7.tmp"2⤵
- Creates scheduled task(s)
PID:2056
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"2⤵PID:3988
-
-
C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:184
-