Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 16:05
Static task
static1
Behavioral task
behavioral1
Sample
03cbf1b9632c3bcd5c979a05f90b160f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
03cbf1b9632c3bcd5c979a05f90b160f.exe
-
Size
1.1MB
-
MD5
03cbf1b9632c3bcd5c979a05f90b160f
-
SHA1
2ea6b9defe7286687c1fb6c26f7e90ad200fd1c4
-
SHA256
2bc690b250672666e2a34800b808d748773492e1d250034505239d03b7882f4b
-
SHA512
9163ae9d26ce579aeeda107e5d6d6c37d64c731d94742a982b2ddb0f153a9d84fc40058a87d68b1b79fe190b9d8f31f207f95c72904847a36fe2d45cfc60afef
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2136-126-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral2/memory/2136-128-0x0000000000400000-0x0000000000481000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exedescription pid process target process PID 1456 set thread context of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exepowershell.exepid process 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 2188 powershell.exe 2188 powershell.exe 2188 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exepowershell.exedescription pid process Token: SeDebugPrivilege 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe Token: SeDebugPrivilege 2188 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
03cbf1b9632c3bcd5c979a05f90b160f.exedescription pid process target process PID 1456 wrote to memory of 2188 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 1456 wrote to memory of 2188 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 1456 wrote to memory of 2188 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe powershell.exe PID 1456 wrote to memory of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1456 wrote to memory of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1456 wrote to memory of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1456 wrote to memory of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1456 wrote to memory of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1456 wrote to memory of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe PID 1456 wrote to memory of 2136 1456 03cbf1b9632c3bcd5c979a05f90b160f.exe 03cbf1b9632c3bcd5c979a05f90b160f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"C:\Users\Admin\AppData\Local\Temp\03cbf1b9632c3bcd5c979a05f90b160f.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1456-121-0x0000000006410000-0x0000000006419000-memory.dmpFilesize
36KB
-
memory/1456-116-0x0000000005DC0000-0x0000000005DC1000-memory.dmpFilesize
4KB
-
memory/1456-117-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/1456-118-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/1456-119-0x00000000058C0000-0x0000000005DBE000-memory.dmpFilesize
5.0MB
-
memory/1456-120-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/1456-122-0x000000007F4F0000-0x000000007F4F1000-memory.dmpFilesize
4KB
-
memory/1456-123-0x0000000006730000-0x00000000067B6000-memory.dmpFilesize
536KB
-
memory/1456-124-0x0000000001A10000-0x0000000001A4E000-memory.dmpFilesize
248KB
-
memory/1456-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/2136-128-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/2136-127-0x000000000047B390-mapping.dmp
-
memory/2136-126-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/2188-131-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/2188-139-0x0000000008080000-0x0000000008081000-memory.dmpFilesize
4KB
-
memory/2188-132-0x0000000007920000-0x0000000007921000-memory.dmpFilesize
4KB
-
memory/2188-133-0x00000000078A0000-0x00000000078A1000-memory.dmpFilesize
4KB
-
memory/2188-134-0x0000000007FC0000-0x0000000007FC1000-memory.dmpFilesize
4KB
-
memory/2188-135-0x0000000008210000-0x0000000008211000-memory.dmpFilesize
4KB
-
memory/2188-136-0x0000000008280000-0x0000000008281000-memory.dmpFilesize
4KB
-
memory/2188-137-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/2188-138-0x0000000004E32000-0x0000000004E33000-memory.dmpFilesize
4KB
-
memory/2188-125-0x0000000000000000-mapping.dmp
-
memory/2188-140-0x00000000086D0000-0x00000000086D1000-memory.dmpFilesize
4KB
-
memory/2188-141-0x0000000008950000-0x0000000008951000-memory.dmpFilesize
4KB
-
memory/2188-149-0x0000000009930000-0x0000000009963000-memory.dmpFilesize
204KB
-
memory/2188-156-0x00000000098F0000-0x00000000098F1000-memory.dmpFilesize
4KB
-
memory/2188-161-0x0000000009A60000-0x0000000009A61000-memory.dmpFilesize
4KB
-
memory/2188-163-0x0000000004E33000-0x0000000004E34000-memory.dmpFilesize
4KB
-
memory/2188-162-0x000000007ECD0000-0x000000007ECD1000-memory.dmpFilesize
4KB
-
memory/2188-164-0x0000000009C20000-0x0000000009C21000-memory.dmpFilesize
4KB