Analysis
-
max time kernel
12s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-04-2021 15:45
Static task
static1
Behavioral task
behavioral1
Sample
98d5dd6c09fa093e791e3c18a9526859.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
98d5dd6c09fa093e791e3c18a9526859.exe
Resource
win10v20210410
General
-
Target
98d5dd6c09fa093e791e3c18a9526859.exe
-
Size
307KB
-
MD5
98d5dd6c09fa093e791e3c18a9526859
-
SHA1
758dbd528a61ac56767fab89600c1656d20693bd
-
SHA256
a045c1cc2b85a5106a89a970262a3ba07dc65d96573401f1f31b4f9867ba7130
-
SHA512
bc4c4875694b7f6d9e01712a6b9e86352bd1350acb4357031c4a688af9b942835cb52e36ff35ffef3f639eb6fd372c8deb8aa0bb48aadf0ed4b376aa1035882a
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1820 taskkill.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exetaskkill.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1700 WMIC.exe Token: SeSecurityPrivilege 1700 WMIC.exe Token: SeTakeOwnershipPrivilege 1700 WMIC.exe Token: SeLoadDriverPrivilege 1700 WMIC.exe Token: SeSystemProfilePrivilege 1700 WMIC.exe Token: SeSystemtimePrivilege 1700 WMIC.exe Token: SeProfSingleProcessPrivilege 1700 WMIC.exe Token: SeIncBasePriorityPrivilege 1700 WMIC.exe Token: SeCreatePagefilePrivilege 1700 WMIC.exe Token: SeBackupPrivilege 1700 WMIC.exe Token: SeRestorePrivilege 1700 WMIC.exe Token: SeShutdownPrivilege 1700 WMIC.exe Token: SeDebugPrivilege 1700 WMIC.exe Token: SeSystemEnvironmentPrivilege 1700 WMIC.exe Token: SeRemoteShutdownPrivilege 1700 WMIC.exe Token: SeUndockPrivilege 1700 WMIC.exe Token: SeManageVolumePrivilege 1700 WMIC.exe Token: 33 1700 WMIC.exe Token: 34 1700 WMIC.exe Token: 35 1700 WMIC.exe Token: SeIncreaseQuotaPrivilege 1700 WMIC.exe Token: SeSecurityPrivilege 1700 WMIC.exe Token: SeTakeOwnershipPrivilege 1700 WMIC.exe Token: SeLoadDriverPrivilege 1700 WMIC.exe Token: SeSystemProfilePrivilege 1700 WMIC.exe Token: SeSystemtimePrivilege 1700 WMIC.exe Token: SeProfSingleProcessPrivilege 1700 WMIC.exe Token: SeIncBasePriorityPrivilege 1700 WMIC.exe Token: SeCreatePagefilePrivilege 1700 WMIC.exe Token: SeBackupPrivilege 1700 WMIC.exe Token: SeRestorePrivilege 1700 WMIC.exe Token: SeShutdownPrivilege 1700 WMIC.exe Token: SeDebugPrivilege 1700 WMIC.exe Token: SeSystemEnvironmentPrivilege 1700 WMIC.exe Token: SeRemoteShutdownPrivilege 1700 WMIC.exe Token: SeUndockPrivilege 1700 WMIC.exe Token: SeManageVolumePrivilege 1700 WMIC.exe Token: 33 1700 WMIC.exe Token: 34 1700 WMIC.exe Token: 35 1700 WMIC.exe Token: SeDebugPrivilege 1820 taskkill.exe Token: SeIncreaseQuotaPrivilege 908 WMIC.exe Token: SeSecurityPrivilege 908 WMIC.exe Token: SeTakeOwnershipPrivilege 908 WMIC.exe Token: SeLoadDriverPrivilege 908 WMIC.exe Token: SeSystemProfilePrivilege 908 WMIC.exe Token: SeSystemtimePrivilege 908 WMIC.exe Token: SeProfSingleProcessPrivilege 908 WMIC.exe Token: SeIncBasePriorityPrivilege 908 WMIC.exe Token: SeCreatePagefilePrivilege 908 WMIC.exe Token: SeBackupPrivilege 908 WMIC.exe Token: SeRestorePrivilege 908 WMIC.exe Token: SeShutdownPrivilege 908 WMIC.exe Token: SeDebugPrivilege 908 WMIC.exe Token: SeSystemEnvironmentPrivilege 908 WMIC.exe Token: SeRemoteShutdownPrivilege 908 WMIC.exe Token: SeUndockPrivilege 908 WMIC.exe Token: SeManageVolumePrivilege 908 WMIC.exe Token: 33 908 WMIC.exe Token: 34 908 WMIC.exe Token: 35 908 WMIC.exe Token: SeIncreaseQuotaPrivilege 908 WMIC.exe Token: SeSecurityPrivilege 908 WMIC.exe Token: SeTakeOwnershipPrivilege 908 WMIC.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
98d5dd6c09fa093e791e3c18a9526859.exeWScript.execmd.exedescription pid process target process PID 788 wrote to memory of 1984 788 98d5dd6c09fa093e791e3c18a9526859.exe WScript.exe PID 788 wrote to memory of 1984 788 98d5dd6c09fa093e791e3c18a9526859.exe WScript.exe PID 788 wrote to memory of 1984 788 98d5dd6c09fa093e791e3c18a9526859.exe WScript.exe PID 788 wrote to memory of 1984 788 98d5dd6c09fa093e791e3c18a9526859.exe WScript.exe PID 1984 wrote to memory of 1788 1984 WScript.exe cmd.exe PID 1984 wrote to memory of 1788 1984 WScript.exe cmd.exe PID 1984 wrote to memory of 1788 1984 WScript.exe cmd.exe PID 1984 wrote to memory of 1788 1984 WScript.exe cmd.exe PID 1788 wrote to memory of 1700 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 1700 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 1700 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 1700 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 1820 1788 cmd.exe taskkill.exe PID 1788 wrote to memory of 1820 1788 cmd.exe taskkill.exe PID 1788 wrote to memory of 1820 1788 cmd.exe taskkill.exe PID 1788 wrote to memory of 1820 1788 cmd.exe taskkill.exe PID 1788 wrote to memory of 908 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 908 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 908 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 908 1788 cmd.exe WMIC.exe PID 1788 wrote to memory of 564 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 564 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 564 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 564 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 1644 1788 cmd.exe WScript.exe PID 1788 wrote to memory of 1644 1788 cmd.exe WScript.exe PID 1788 wrote to memory of 1644 1788 cmd.exe WScript.exe PID 1788 wrote to memory of 1644 1788 cmd.exe WScript.exe PID 1788 wrote to memory of 1672 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 1672 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 1672 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 1672 1788 cmd.exe PING.EXE PID 1788 wrote to memory of 1796 1788 cmd.exe cmd.exe PID 1788 wrote to memory of 1796 1788 cmd.exe cmd.exe PID 1788 wrote to memory of 1796 1788 cmd.exe cmd.exe PID 1788 wrote to memory of 1796 1788 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98d5dd6c09fa093e791e3c18a9526859.exe"C:\Users\Admin\AppData\Local\Temp\98d5dd6c09fa093e791e3c18a9526859.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\updateW\java.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\updateW\windowsapp.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic process where ExecutablePath='C:\\Windows (x86)\\explorer.exe' delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic process where name='xmrig.exe' delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\updateW\upd3.vbs"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\updateW\windowsapp.bat"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\updateW\java.vbsMD5
399bcbd390bbead43b52e37d6995a2c0
SHA1e0d3cba8a70da9f354cb7ee475d3d38881cadd87
SHA25661e69b8bed7505b56f5c6748681dfca443e5e65a7981d043a84d0f696eae5574
SHA512c174506c51e6e46510655ae1750f4f2626d570471e8a8155182bec5881bc32507ce06b5d46f9b7084194e02769f15f40d46139aa3addcad5738ade273e72fa13
-
C:\Users\Admin\AppData\Local\Temp\updateW\upd3.vbsMD5
05d48b39d8e8e92a13256d9b3cb79cce
SHA1cd1f23ccb928132ec9ef415e12a739edb72149cb
SHA25601889de4022fd096e6197cf9ea6b7082da191b6053a048be0e487c4640cfdff6
SHA51204680e0e7484c176f7db73af54db87d11a82ae238c0f43a2d27354d30a4e045f70b988c9a66f8ec76901797569ca45bf669d4a59d70624a1232555c23111230e
-
C:\Users\Admin\AppData\Local\Temp\updateW\windowsapp.batMD5
9e068fba166fc4dc6fdd7059a71cbda0
SHA12ec36119a97772fcebb8efbfab8b00a26c7519b3
SHA256deaa0392f0e31151176926cdbb853ad39771f44019dbd8d7c3b1e65b4ee09770
SHA512ef95bee35fcf69a2c9dc8534a24df0c58420d68cb793e51f7a09a7366033b47e50286b4d191e2e591d34c9addcab17c4a2b827cfde8bfdabc1f2136d95ae8730
-
memory/564-69-0x0000000000000000-mapping.dmp
-
memory/788-60-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/908-68-0x0000000000000000-mapping.dmp
-
memory/1644-72-0x0000000000000000-mapping.dmp
-
memory/1672-73-0x0000000000000000-mapping.dmp
-
memory/1700-66-0x0000000000000000-mapping.dmp
-
memory/1788-65-0x0000000000000000-mapping.dmp
-
memory/1796-75-0x0000000000000000-mapping.dmp
-
memory/1820-67-0x0000000000000000-mapping.dmp
-
memory/1984-61-0x0000000000000000-mapping.dmp