Analysis
-
max time kernel
123s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 15:04
Static task
static1
Behavioral task
behavioral1
Sample
4HwMTLRFvpnRf2a.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
4HwMTLRFvpnRf2a.exe
Resource
win10v20210410
General
-
Target
4HwMTLRFvpnRf2a.exe
-
Size
2.2MB
-
MD5
ec835ba0c96c625b726e90871fa4408e
-
SHA1
f4f79d8c5d99dd6435f72bcf9c1d90aab96e47ab
-
SHA256
6a156918ff4ace56113e28bfc878aab413d3021fc89f0e6dad59744ac25874fe
-
SHA512
eb40160fc4e8911920e8f0537c38d665eaa644b3d48159e8143b0e6cae076ca3c81aab59c28e3440c052280d5664798db37399e4855a5c82649f0a4c8fd1ee6b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
4HwMTLRFvpnRf2a.exepid process 1040 4HwMTLRFvpnRf2a.exe 1040 4HwMTLRFvpnRf2a.exe 1040 4HwMTLRFvpnRf2a.exe 1040 4HwMTLRFvpnRf2a.exe 1040 4HwMTLRFvpnRf2a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4HwMTLRFvpnRf2a.exedescription pid process Token: SeDebugPrivilege 1040 4HwMTLRFvpnRf2a.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
4HwMTLRFvpnRf2a.exedescription pid process target process PID 1040 wrote to memory of 780 1040 4HwMTLRFvpnRf2a.exe schtasks.exe PID 1040 wrote to memory of 780 1040 4HwMTLRFvpnRf2a.exe schtasks.exe PID 1040 wrote to memory of 780 1040 4HwMTLRFvpnRf2a.exe schtasks.exe PID 1040 wrote to memory of 780 1040 4HwMTLRFvpnRf2a.exe schtasks.exe PID 1040 wrote to memory of 1472 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1472 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1472 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1472 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 700 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 700 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 700 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 700 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1480 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1480 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1480 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1480 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1312 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1312 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1312 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1312 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1152 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1152 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1152 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe PID 1040 wrote to memory of 1152 1040 4HwMTLRFvpnRf2a.exe 4HwMTLRFvpnRf2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UXnYcxbuH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96D3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp96D3.tmpMD5
41a9bf8d52203f10b617ef62e4a582cc
SHA142d6bd2370aa813da0eb5fed5664de335e801e5b
SHA256a61ddba7dfb71c62db282b6864d9452552ccf31e3116eed4d5dc886e6be40c88
SHA512166333a5a902398d01e78b688e4e0c047c588b74ed7d6efca48dd8b9e789d6f2a0eb7264308422f6c0b12e0024eaa8180327f8b6821af00346ca35668f3b4b15
-
memory/780-65-0x0000000000000000-mapping.dmp
-
memory/1040-59-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1040-61-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/1040-62-0x00000000002B0000-0x00000000002BE000-memory.dmpFilesize
56KB
-
memory/1040-63-0x0000000005170000-0x00000000051EC000-memory.dmpFilesize
496KB
-
memory/1040-64-0x00000000049D0000-0x0000000004A0E000-memory.dmpFilesize
248KB