Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-04-2021 15:07
Static task
static1
Behavioral task
behavioral1
Sample
03cbf1b9632c3bcd5c979a05f90b160f.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
03cbf1b9632c3bcd5c979a05f90b160f.exe
-
Size
1.1MB
-
MD5
03cbf1b9632c3bcd5c979a05f90b160f
-
SHA1
2ea6b9defe7286687c1fb6c26f7e90ad200fd1c4
-
SHA256
2bc690b250672666e2a34800b808d748773492e1d250034505239d03b7882f4b
-
SHA512
9163ae9d26ce579aeeda107e5d6d6c37d64c731d94742a982b2ddb0f153a9d84fc40058a87d68b1b79fe190b9d8f31f207f95c72904847a36fe2d45cfc60afef
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1632-67-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral1/memory/1632-73-0x0000000000400000-0x0000000000481000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exedescription pid process target process PID 1992 set thread context of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exepowershell.exepid process 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 928 powershell.exe 928 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exepowershell.exedescription pid process Token: SeDebugPrivilege 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe Token: SeDebugPrivilege 928 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exedescription pid process target process PID 1992 wrote to memory of 928 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 1992 wrote to memory of 928 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 1992 wrote to memory of 928 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 1992 wrote to memory of 928 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1992 wrote to memory of 1632 1992 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/928-86-0x0000000006160000-0x0000000006161000-memory.dmpFilesize
4KB
-
memory/928-95-0x0000000005FA0000-0x0000000005FA1000-memory.dmpFilesize
4KB
-
memory/928-71-0x0000000001E50000-0x0000000001E51000-memory.dmpFilesize
4KB
-
memory/928-109-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/928-72-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/928-94-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/928-66-0x0000000000000000-mapping.dmp
-
memory/928-87-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/928-85-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/928-80-0x0000000005FE0000-0x0000000005FE1000-memory.dmpFilesize
4KB
-
memory/928-110-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/928-77-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/928-76-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/928-74-0x0000000001FA0000-0x0000000002BEA000-memory.dmpFilesize
12.3MB
-
memory/1632-73-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1632-69-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1632-67-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1632-68-0x000000000047B390-mapping.dmp
-
memory/1992-61-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/1992-59-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/1992-65-0x0000000000AD0000-0x0000000000B0E000-memory.dmpFilesize
248KB
-
memory/1992-64-0x00000000050B0000-0x0000000005136000-memory.dmpFilesize
536KB
-
memory/1992-63-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1992-62-0x0000000000A10000-0x0000000000A19000-memory.dmpFilesize
36KB