Analysis

  • max time kernel
    34s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    15/05/2021, 15:04

General

  • Target

    2.exe

  • Size

    1.9MB

  • MD5

    5fd5ef8825f390a3c7dac57659ee7079

  • SHA1

    364c83ce8542086e50f4e62050a715613fcc361c

  • SHA256

    9561ae1eae830aed3ade4c339faac7240320f6a01e203b5c0521a9ed09e686fd

  • SHA512

    fc1a6e185b4abb0ee9e9c0eafd89cce54744a4b42bfbbf14bac37ce1cc85eb75358fb0d99e83c776694862854355d64d5743e7be0966fc97dec08500840a2454

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Osi.wks
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\SysWOW64\findstr.exe
          findstr /V /R "^LiUOCkNiYaUJhgUGDJZrloHmYxLqOcYNmCEuaoPGLxSLfVHkLUkImvvDmxPiAMzDxupLKNhcTaaPdWleNmgTpdgeuwGYzIyYqgdoLWBXGQOutGjDpMzqnmzrSiE$" Ero.wks
          4⤵
            PID:1752
          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Presto.exe.com
            Presto.exe.com s
            4⤵
            • Executes dropped EXE
            PID:1856
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 30
            4⤵
            • Runs ping.exe
            PID:1720

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2040-60-0x0000000076281000-0x0000000076283000-memory.dmp

            Filesize

            8KB