ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b

General

Target

IMAGE20210406_490133692.exe
Size

1.6MB
MD5

432494553bb7b05ce1970f180968aac3
SHA1

c1147f87babcf9c0ce3e278ded158c1343dc7e92
SHA256

ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b
SHA512

bf961ad8680d045a9a2555018695ed2e0a607feda2b60a3936be19f380985742075349d3d9112a8894f5a0c0fef2c9c668e5469ca4005ca7109bf8925b5067fd

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

IMAGE20210406_490133692.exe

description pid process target process

PID 3888 set thread context of 184 3888 IMAGE20210406_490133692.exe IMAGE20210406_490133692.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2056 schtasks.exe

description	pid	process	target process
PID 3888 set thread context of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe

pid	process
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

IMAGE20210406_490133692.exepowershell.exepowershell.exepowershell.exe

pid	process
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
4064	powershell.exe
2400	powershell.exe
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
2764	powershell.exe
2400	powershell.exe
4064	powershell.exe
2764	powershell.exe
2400	powershell.exe
4064	powershell.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

IMAGE20210406_490133692.exepowershell.exepowershell.exepowershell.exeIMAGE20210406_490133692.exe

description	pid	process
Token: SeDebugPrivilege	3888	IMAGE20210406_490133692.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeShutdownPrivilege	184	IMAGE20210406_490133692.exe
Token: SeCreatePagefilePrivilege	184	IMAGE20210406_490133692.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

IMAGE20210406_490133692.exe

description	pid	process	target process
PID 3888 wrote to memory of 2400	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2400	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2400	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 4064	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 4064	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 4064	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2056	3888	IMAGE20210406_490133692.exe	schtasks.exe
PID 3888 wrote to memory of 2056	3888	IMAGE20210406_490133692.exe	schtasks.exe
PID 3888 wrote to memory of 2056	3888	IMAGE20210406_490133692.exe	schtasks.exe
PID 3888 wrote to memory of 2764	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2764	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2764	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 3988	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 3988	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 3988	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe

C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nTLvOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8F7.tmp"
2⤵
- Creates scheduled task(s)
PID:2056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
2⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
f68fb2ae9ce2ab96c667e183f264a454

SHA1
063529079f473efe232c55b399bc202cd17c71d8

SHA256
b21fc71815df2fae456a2c7ef1d0cb11549d0b0bc7f2b39128eda39daf4933af

SHA512
d3a2499dacd7f79b01863e14465a72fe5b94697c2f83847ae00b033862cee75164f50566d729b726d722ed7ddc864031fcf738afbc875b7afcefeb4ba02e5b95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
890e913f0960dd3354be5c2fc1328856

SHA1
a3850bcd8d37a8da69c76cf2a05831fcaa7a0518

SHA256
d6640da08e6c17cea91d07468f6b7470dd331bfc88e2fa6e6d5634806a63685e

SHA512
2c9cde5ba98ef921c48ef2166ff9e08e736995748529510764a62d26167b58037debb367e07151517cc1f97b9390cc8ab301f2755337943f6b37ee6c4f3b5736

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF8F7.tmp
MD5
8385f4b0fcc3d2343685528ed2c85b5f

SHA1
d79d284dade07ec54128bbb4c7ba21b55205e455

SHA256
bfd07e46f483b5f502b74f1cfbd4a68af37e751fa869328674153c10af671272

SHA512
a1181d854268e03a95b7cda25c9db6a7edcd1a492f7d7b70147a2da1a0bf5f069eeac7036106ae006a7b816543cdb6073814161b5d62b333e7608e51036196c4

Download Submit
memory/184-36-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/184-37-0x000000000049D8CA-mapping.dmp

Download
memory/184-45-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2056-17-0x0000000000000000-mapping.dmp

Download
memory/2400-50-0x0000000007E70000-0x0000000007E71000-memory.dmp

Filesize
4KB

Download
memory/2400-19-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/2400-79-0x00000000096A0000-0x00000000096A1000-memory.dmp

Filesize
4KB

Download
memory/2400-83-0x0000000009810000-0x0000000009811000-memory.dmp

Filesize
4KB

Download
memory/2400-15-0x0000000000000000-mapping.dmp

Download
memory/2400-41-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

Filesize
4KB

Download
memory/2400-78-0x000000007EA70000-0x000000007EA71000-memory.dmp

Filesize
4KB

Download
memory/2400-52-0x0000000008760000-0x0000000008761000-memory.dmp

Filesize
4KB

Download
memory/2400-92-0x00000000099E0000-0x00000000099E1000-memory.dmp

Filesize
4KB

Download
memory/2400-20-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/2400-22-0x00000000076C0000-0x00000000076C1000-memory.dmp

Filesize
4KB

Download
memory/2400-24-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/2400-95-0x0000000004BF3000-0x0000000004BF4000-memory.dmp

Filesize
4KB

Download
memory/2400-26-0x0000000004BF2000-0x0000000004BF3000-memory.dmp

Filesize
4KB

Download
memory/2764-77-0x000000007F6A0000-0x000000007F6A1000-memory.dmp

Filesize
4KB

Download
memory/2764-38-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-98-0x0000000009450000-0x0000000009451000-memory.dmp

Filesize
4KB

Download
memory/2764-32-0x0000000000000000-mapping.dmp

Download
memory/2764-96-0x0000000006B53000-0x0000000006B54000-memory.dmp

Filesize
4KB

Download
memory/2764-61-0x0000000008FA0000-0x0000000008FD3000-memory.dmp

Filesize
204KB

Download
memory/2764-44-0x0000000006B52000-0x0000000006B53000-memory.dmp

Filesize
4KB

Download
memory/2764-43-0x0000000006B50000-0x0000000006B51000-memory.dmp

Filesize
4KB

Download
memory/3888-8-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/3888-11-0x0000000005140000-0x0000000005144000-memory.dmp

Filesize
16KB

Download
memory/3888-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/3888-5-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3888-14-0x0000000008210000-0x000000000830A000-memory.dmp

Filesize
1000KB

Download
memory/3888-13-0x0000000005C50000-0x0000000005D49000-memory.dmp

Filesize
996KB

Download
memory/3888-12-0x000000007E7B0000-0x000000007E7B1000-memory.dmp

Filesize
4KB

Download
memory/3888-6-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/3888-7-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/3888-9-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3888-10-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/4064-16-0x0000000000000000-mapping.dmp

Download
memory/4064-82-0x000000007F130000-0x000000007F131000-memory.dmp

Filesize
4KB

Download
memory/4064-27-0x00000000045F2000-0x00000000045F3000-memory.dmp

Filesize
4KB

Download
memory/4064-34-0x00000000077A0000-0x00000000077A1000-memory.dmp

Filesize
4KB

Download
memory/4064-97-0x00000000045F3000-0x00000000045F4000-memory.dmp

Filesize
4KB

Download
memory/4064-31-0x0000000007820000-0x0000000007821000-memory.dmp

Filesize
4KB

Download
memory/4064-29-0x0000000006F60000-0x0000000006F61000-memory.dmp

Filesize
4KB

Download
memory/4064-102-0x0000000009280000-0x0000000009281000-memory.dmp

Filesize
4KB

Download
memory/4064-56-0x0000000008140000-0x0000000008141000-memory.dmp

Filesize
4KB

Download
memory/4064-25-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/4064-18-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads