ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b

Analysis

max time kernel
126s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
06-04-2021 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMAGE20210406_490133692.exe
Size

1.6MB
MD5

432494553bb7b05ce1970f180968aac3
SHA1

c1147f87babcf9c0ce3e278ded158c1343dc7e92
SHA256

ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b
SHA512

bf961ad8680d045a9a2555018695ed2e0a607feda2b60a3936be19f380985742075349d3d9112a8894f5a0c0fef2c9c668e5469ca4005ca7109bf8925b5067fd

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

IMAGE20210406_490133692.exe

description pid process target process

PID 3888 set thread context of 184 3888 IMAGE20210406_490133692.exe IMAGE20210406_490133692.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2056 schtasks.exe

description	pid	process	target process
PID 3888 set thread context of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe

pid	process
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

IMAGE20210406_490133692.exepowershell.exepowershell.exepowershell.exe

pid	process
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
4064	powershell.exe
2400	powershell.exe
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
3888	IMAGE20210406_490133692.exe
2764	powershell.exe
2400	powershell.exe
4064	powershell.exe
2764	powershell.exe
2400	powershell.exe
4064	powershell.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

IMAGE20210406_490133692.exepowershell.exepowershell.exepowershell.exeIMAGE20210406_490133692.exe

description	pid	process
Token: SeDebugPrivilege	3888	IMAGE20210406_490133692.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeShutdownPrivilege	184	IMAGE20210406_490133692.exe
Token: SeCreatePagefilePrivilege	184	IMAGE20210406_490133692.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

IMAGE20210406_490133692.exe

description	pid	process	target process
PID 3888 wrote to memory of 2400	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2400	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2400	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 4064	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 4064	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 4064	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2056	3888	IMAGE20210406_490133692.exe	schtasks.exe
PID 3888 wrote to memory of 2056	3888	IMAGE20210406_490133692.exe	schtasks.exe
PID 3888 wrote to memory of 2056	3888	IMAGE20210406_490133692.exe	schtasks.exe
PID 3888 wrote to memory of 2764	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2764	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 2764	3888	IMAGE20210406_490133692.exe	powershell.exe
PID 3888 wrote to memory of 3988	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 3988	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 3988	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe
PID 3888 wrote to memory of 184	3888	IMAGE20210406_490133692.exe	IMAGE20210406_490133692.exe

C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nTLvOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8F7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
  "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
  2⤵
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
  "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
f68fb2ae9ce2ab96c667e183f264a454

SHA1
063529079f473efe232c55b399bc202cd17c71d8

SHA256
b21fc71815df2fae456a2c7ef1d0cb11549d0b0bc7f2b39128eda39daf4933af

SHA512
d3a2499dacd7f79b01863e14465a72fe5b94697c2f83847ae00b033862cee75164f50566d729b726d722ed7ddc864031fcf738afbc875b7afcefeb4ba02e5b95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
890e913f0960dd3354be5c2fc1328856

SHA1
a3850bcd8d37a8da69c76cf2a05831fcaa7a0518

SHA256
d6640da08e6c17cea91d07468f6b7470dd331bfc88e2fa6e6d5634806a63685e

SHA512
2c9cde5ba98ef921c48ef2166ff9e08e736995748529510764a62d26167b58037debb367e07151517cc1f97b9390cc8ab301f2755337943f6b37ee6c4f3b5736

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF8F7.tmp

MD5
8385f4b0fcc3d2343685528ed2c85b5f

SHA1
d79d284dade07ec54128bbb4c7ba21b55205e455

SHA256
bfd07e46f483b5f502b74f1cfbd4a68af37e751fa869328674153c10af671272

SHA512
a1181d854268e03a95b7cda25c9db6a7edcd1a492f7d7b70147a2da1a0bf5f069eeac7036106ae006a7b816543cdb6073814161b5d62b333e7608e51036196c4

Download Submit
memory/184-36-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/184-37-0x000000000049D8CA-mapping.dmp

Download
memory/184-45-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2056-17-0x0000000000000000-mapping.dmp

Download
memory/2400-50-0x0000000007E70000-0x0000000007E71000-memory.dmp

Filesize
4KB

Download
memory/2400-19-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/2400-79-0x00000000096A0000-0x00000000096A1000-memory.dmp

Filesize
4KB

Download
memory/2400-83-0x0000000009810000-0x0000000009811000-memory.dmp

Filesize
4KB

Download
memory/2400-15-0x0000000000000000-mapping.dmp

Download
memory/2400-41-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

Filesize
4KB

Download
memory/2400-78-0x000000007EA70000-0x000000007EA71000-memory.dmp

Filesize
4KB

Download
memory/2400-52-0x0000000008760000-0x0000000008761000-memory.dmp

Filesize
4KB

Download
memory/2400-92-0x00000000099E0000-0x00000000099E1000-memory.dmp

Filesize
4KB

Download
memory/2400-20-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/2400-22-0x00000000076C0000-0x00000000076C1000-memory.dmp

Filesize
4KB

Download
memory/2400-24-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/2400-95-0x0000000004BF3000-0x0000000004BF4000-memory.dmp

Filesize
4KB

Download
memory/2400-26-0x0000000004BF2000-0x0000000004BF3000-memory.dmp

Filesize
4KB

Download
memory/2764-77-0x000000007F6A0000-0x000000007F6A1000-memory.dmp

Filesize
4KB

Download
memory/2764-38-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-98-0x0000000009450000-0x0000000009451000-memory.dmp

Filesize
4KB

Download
memory/2764-32-0x0000000000000000-mapping.dmp

Download
memory/2764-96-0x0000000006B53000-0x0000000006B54000-memory.dmp

Filesize
4KB

Download
memory/2764-61-0x0000000008FA0000-0x0000000008FD3000-memory.dmp

Filesize
204KB

Download
memory/2764-44-0x0000000006B52000-0x0000000006B53000-memory.dmp

Filesize
4KB

Download
memory/2764-43-0x0000000006B50000-0x0000000006B51000-memory.dmp

Filesize
4KB

Download
memory/3888-8-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/3888-11-0x0000000005140000-0x0000000005144000-memory.dmp

Filesize
16KB

Download
memory/3888-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/3888-5-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3888-14-0x0000000008210000-0x000000000830A000-memory.dmp

Filesize
1000KB

Download
memory/3888-13-0x0000000005C50000-0x0000000005D49000-memory.dmp

Filesize
996KB

Download
memory/3888-12-0x000000007E7B0000-0x000000007E7B1000-memory.dmp

Filesize
4KB

Download
memory/3888-6-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/3888-7-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/3888-9-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3888-10-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/4064-16-0x0000000000000000-mapping.dmp

Download
memory/4064-82-0x000000007F130000-0x000000007F131000-memory.dmp

Filesize
4KB

Download
memory/4064-27-0x00000000045F2000-0x00000000045F3000-memory.dmp

Filesize
4KB

Download
memory/4064-34-0x00000000077A0000-0x00000000077A1000-memory.dmp

Filesize
4KB

Download
memory/4064-97-0x00000000045F3000-0x00000000045F4000-memory.dmp

Filesize
4KB

Download
memory/4064-31-0x0000000007820000-0x0000000007821000-memory.dmp

Filesize
4KB

Download
memory/4064-29-0x0000000006F60000-0x0000000006F61000-memory.dmp

Filesize
4KB

Download
memory/4064-102-0x0000000009280000-0x0000000009281000-memory.dmp

Filesize
4KB

Download
memory/4064-56-0x0000000008140000-0x0000000008141000-memory.dmp

Filesize
4KB

Download
memory/4064-25-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/4064-18-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download