Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 15:07
Static task
static1
Behavioral task
behavioral1
Sample
03cbf1b9632c3bcd5c979a05f90b160f.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
03cbf1b9632c3bcd5c979a05f90b160f.exe
-
Size
1.1MB
-
MD5
03cbf1b9632c3bcd5c979a05f90b160f
-
SHA1
2ea6b9defe7286687c1fb6c26f7e90ad200fd1c4
-
SHA256
2bc690b250672666e2a34800b808d748773492e1d250034505239d03b7882f4b
-
SHA512
9163ae9d26ce579aeeda107e5d6d6c37d64c731d94742a982b2ddb0f153a9d84fc40058a87d68b1b79fe190b9d8f31f207f95c72904847a36fe2d45cfc60afef
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2076-126-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral2/memory/2076-136-0x0000000000400000-0x0000000000481000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exedescription pid process target process PID 3152 set thread context of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exepowershell.exepid process 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 1624 powershell.exe 1624 powershell.exe 1624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exepowershell.exedescription pid process Token: SeDebugPrivilege 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe Token: SeDebugPrivilege 1624 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exedescription pid process target process PID 3152 wrote to memory of 1624 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 3152 wrote to memory of 1624 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 3152 wrote to memory of 1624 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 3152 wrote to memory of 2208 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2208 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2208 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 4016 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 4016 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 4016 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 4068 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 4068 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 4068 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 3152 wrote to memory of 2076 3152 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1624-139-0x00000000069B2000-0x00000000069B3000-memory.dmpFilesize
4KB
-
memory/1624-137-0x0000000006F60000-0x0000000006F61000-memory.dmpFilesize
4KB
-
memory/1624-131-0x0000000006FF0000-0x0000000006FF1000-memory.dmpFilesize
4KB
-
memory/1624-132-0x0000000006D20000-0x0000000006D21000-memory.dmpFilesize
4KB
-
memory/1624-163-0x00000000069B3000-0x00000000069B4000-memory.dmpFilesize
4KB
-
memory/1624-162-0x000000007ECA0000-0x000000007ECA1000-memory.dmpFilesize
4KB
-
memory/1624-161-0x0000000008FE0000-0x0000000008FE1000-memory.dmpFilesize
4KB
-
memory/1624-156-0x0000000008E70000-0x0000000008E71000-memory.dmpFilesize
4KB
-
memory/1624-149-0x0000000008E90000-0x0000000008EC3000-memory.dmpFilesize
204KB
-
memory/1624-141-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB
-
memory/1624-125-0x0000000000000000-mapping.dmp
-
memory/1624-140-0x00000000080F0000-0x00000000080F1000-memory.dmpFilesize
4KB
-
memory/1624-133-0x0000000007720000-0x0000000007721000-memory.dmpFilesize
4KB
-
memory/1624-130-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB
-
memory/1624-138-0x00000000069B0000-0x00000000069B1000-memory.dmpFilesize
4KB
-
memory/1624-164-0x00000000091A0000-0x00000000091A1000-memory.dmpFilesize
4KB
-
memory/1624-135-0x0000000007800000-0x0000000007801000-memory.dmpFilesize
4KB
-
memory/1624-134-0x0000000007790000-0x0000000007791000-memory.dmpFilesize
4KB
-
memory/2076-127-0x000000000047B390-mapping.dmp
-
memory/2076-136-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/2076-126-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/3152-114-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/3152-124-0x0000000002530000-0x000000000256E000-memory.dmpFilesize
248KB
-
memory/3152-116-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/3152-117-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/3152-121-0x00000000051C0000-0x00000000051C9000-memory.dmpFilesize
36KB
-
memory/3152-122-0x000000007EB30000-0x000000007EB31000-memory.dmpFilesize
4KB
-
memory/3152-123-0x0000000005B20000-0x0000000005BA6000-memory.dmpFilesize
536KB
-
memory/3152-120-0x0000000004DA0000-0x000000000529E000-memory.dmpFilesize
5.0MB
-
memory/3152-119-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/3152-118-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB