Overview

overview

8

Static

static

FBDC41A2C1...11.exe

windows7_x64

8

FBDC41A2C1...11.exe

windows10_x64

8

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08/04/2021, 16:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FBDC41A2C1059FC99B592EF844EE9311.exe
  • Size 1.2MB
  • Sample210408-k4mdclvjvx
  • SHA256 f3fada003d43df7ab5b4f7d41a1b90646797bb41ecb4ca1c3afb37baaba10264
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FBDC41A2C1059FC99B592EF844EE9311.exe
    "C:\Users\Admin\AppData\Local\Temp\FBDC41A2C1059FC99B592EF844EE9311.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3912
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "a" /tr '"C:\Users\Admin\AppData\Roaming\a.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "a" /tr '"C:\Users\Admin\AppData\Roaming\a.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:2100
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4730.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:3792
      • C:\Users\Admin\AppData\Roaming\a.exe
        "C:\Users\Admin\AppData\Roaming\a.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2576

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2576-133-0x0000000009430000-0x0000000009431000-memory.dmp
        Download

        memory/2576-132-0x0000000009930000-0x0000000009931000-memory.dmp
        Download

        memory/2576-130-0x00000000089A0000-0x00000000089A1000-memory.dmp
        Download

        memory/2576-128-0x0000000001210000-0x0000000001212000-memory.dmp
        Download

        memory/2576-127-0x0000000001210000-0x0000000001212000-memory.dmp
        Download

        memory/3912-114-0x0000000000030000-0x0000000000032000-memory.dmp
        Download

        memory/3912-118-0x00000000083D0000-0x00000000083D1000-memory.dmp
        Download

        memory/3912-117-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
        Download

        memory/3912-115-0x0000000000030000-0x0000000000032000-memory.dmp
        Download