4HwMTLRFvpnRf2a.exe

General
Target

4HwMTLRFvpnRf2a.exe

Filesize

2MB

Completed

04-05-2021 15:06

Score
3 /10
MD5

ec835ba0c96c625b726e90871fa4408e

SHA1

f4f79d8c5d99dd6435f72bcf9c1d90aab96e47ab

SHA256

6a156918ff4ace56113e28bfc878aab413d3021fc89f0e6dad59744ac25874fe

Malware Config
Signatures 5

Filter: none

Discovery
Persistence
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    780schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    4HwMTLRFvpnRf2a.exe

    Reported IOCs

    pidprocess
    10404HwMTLRFvpnRf2a.exe
    10404HwMTLRFvpnRf2a.exe
    10404HwMTLRFvpnRf2a.exe
    10404HwMTLRFvpnRf2a.exe
    10404HwMTLRFvpnRf2a.exe
  • Suspicious use of AdjustPrivilegeToken
    4HwMTLRFvpnRf2a.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege10404HwMTLRFvpnRf2a.exe
  • Suspicious use of WriteProcessMemory
    4HwMTLRFvpnRf2a.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1040 wrote to memory of 78010404HwMTLRFvpnRf2a.exeschtasks.exe
    PID 1040 wrote to memory of 78010404HwMTLRFvpnRf2a.exeschtasks.exe
    PID 1040 wrote to memory of 78010404HwMTLRFvpnRf2a.exeschtasks.exe
    PID 1040 wrote to memory of 78010404HwMTLRFvpnRf2a.exeschtasks.exe
    PID 1040 wrote to memory of 147210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 147210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 147210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 147210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 70010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 70010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 70010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 70010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 148010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 148010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 148010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 148010404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 131210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 131210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 131210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 131210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 115210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 115210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 115210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 1040 wrote to memory of 115210404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
    "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UXnYcxbuH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96D3.tmp"
      Creates scheduled task(s)
      PID:780
    • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
      PID:1472
    • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
      PID:700
    • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
      PID:1480
    • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
      PID:1312
    • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
      PID:1152
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp96D3.tmp

                        MD5

                        41a9bf8d52203f10b617ef62e4a582cc

                        SHA1

                        42d6bd2370aa813da0eb5fed5664de335e801e5b

                        SHA256

                        a61ddba7dfb71c62db282b6864d9452552ccf31e3116eed4d5dc886e6be40c88

                        SHA512

                        166333a5a902398d01e78b688e4e0c047c588b74ed7d6efca48dd8b9e789d6f2a0eb7264308422f6c0b12e0024eaa8180327f8b6821af00346ca35668f3b4b15

                      • memory/780-65-0x0000000000000000-mapping.dmp

                      • memory/1040-61-0x0000000005030000-0x0000000005031000-memory.dmp

                      • memory/1040-62-0x00000000002B0000-0x00000000002BE000-memory.dmp

                      • memory/1040-63-0x0000000005170000-0x00000000051EC000-memory.dmp

                      • memory/1040-64-0x00000000049D0000-0x0000000004A0E000-memory.dmp

                      • memory/1040-59-0x00000000002C0000-0x00000000002C1000-memory.dmp