40d82c0d6cd3eacbe4e2b4c3d83e9ba67ef5953cdcc359e6e083fcb03b613fc0

Analysis

max time kernel
16s
max time network
121s
platform
windows10_x64
resource
win10v20210410
submitted
16/06/2021, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file3.exe
Size 386KB
Sample210616-34ccgkhjf6
SHA256 40d82c0d6cd3eacbe4e2b4c3d83e9ba67ef5953cdcc359e6e083fcb03b613fc0
MD5 a1e26413b7d36496c04ec317085fae56
SHA1 d2275470c5ee407cb50b278b0a677daffdc1102e
SHA512 8c58f4455e10c1fd43ccf71d336241d53e342a8a07cc3b20d5cc983ae821d5043d79f2163c1e2bf18fc4105aef7abeeeeb3f54db802ffae46744fc047840b2ae
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2724	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3748	3244	file3.exe	78
PID 3244 wrote to memory of 3748	3244	file3.exe	78
PID 3244 wrote to memory of 3748	3244	file3.exe	78
PID 3748 wrote to memory of 2724	3748	cmd.exe	80
PID 3748 wrote to memory of 2724	3748	cmd.exe	80
PID 3748 wrote to memory of 2724	3748	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\file3.exe
"C:\Users\Admin\AppData\Local\Temp\file3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "file3.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file3.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "file3.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3244-114-0x0000000003480000-0x00000000034AF000-memory.dmp

Download

memory/3244-115-0x0000000000400000-0x000000000324E000-memory.dmp