Analysis
- max time kernel
149s - max time network
140s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/05/2021, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
702843f05e3db0afaa615fdd8f262be6.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
702843f05e3db0afaa615fdd8f262be6.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 702843f05e3db0afaa615fdd8f262be6.exe
- Size 27KB
- Sample210505-mpcn9364f2
- SHA256 e63d3be538ff76863ee863299e16a554e83908abaab1b59128b398d898cebcf7
- MD5 702843f05e3db0afaa615fdd8f262be6
- SHA1 4c2de1531c7072598d4d399147c8add254421a25
- SHA512 eefb2c83fbb2a3d2bdfd7eb2309449ded6243c544eb223820e0f0e1f553a46e9fa975fbeb123b3d7bf9ebe5c884f6eee0340b6a7e09f1ea075a7fa7bb4463102
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk 702843f05e3db0afaa615fdd8f262be6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe Token: 33 856 702843f05e3db0afaa615fdd8f262be6.exe Token: SeIncBasePriorityPrivilege 856 702843f05e3db0afaa615fdd8f262be6.exe