Analysis
- max time kernel
10s - max time network
139s - platform
windows10_x64 - resource
win10v20210410 - submitted
15/06/2021, 08:57
General
- Target Preview.exe
- Size 32KB
- Sample210615-e2sp28qf3j
- SHA256 fd80116dffb4a52d6a31d33d06f3ff943c38f6ada8fd3d9e9ffaeb0422a010a9
Score
9/10
Malware Config
Signatures
- Nirsoft 3 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Preview.exe"C:\Users\Admin\AppData\Local\Temp\Preview.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ac02317-67fb-4bbc-b41f-9ea9c4e4db53\4be8d5cf-9ce4-42f5-83b0-fdbba983af24.exe"C:\Users\Admin\AppData\Local\Temp\5ac02317-67fb-4bbc-b41f-9ea9c4e4db53\4be8d5cf-9ce4-42f5-83b0-fdbba983af24.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\Preview.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ac02317-67fb-4bbc-b41f-9ea9c4e4db53\4be8d5cf-9ce4-42f5-83b0-fdbba983af24.exe"C:\Users\Admin\AppData\Local\Temp\5ac02317-67fb-4bbc-b41f-9ea9c4e4db53\4be8d5cf-9ce4-42f5-83b0-fdbba983af24.exe" /SpecialRun 4101d8 18523⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1844-114-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/1844-116-0x0000000005690000-0x0000000005691000-memory.dmp
memory/1844-117-0x0000000007E20000-0x0000000007E21000-memory.dmp
memory/1844-118-0x00000000011E0000-0x000000000123E000-memory.dmp
memory/1844-119-0x00000000096A0000-0x00000000096A1000-memory.dmp