Analysis
- max time kernel
146s - max time network
145s - platform
windows10_x64 - resource
win10v20210410 - submitted
16/06/2021, 13:48
General
- Target 624115db5496a695953473c3c541baca.exe
- Size 335KB
- Sample210616-praprpdzqj
- SHA256 b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\624115db5496a695953473c3c541baca.exe"C:\Users\Admin\AppData\Local\Temp\624115db5496a695953473c3c541baca.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Hlgnerhnednebtyiqgbjd.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chromee\chromee.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3424-119-0x0000000002420000-0x0000000002421000-memory.dmp
memory/3424-125-0x00000000065E0000-0x000000000663F000-memory.dmp
memory/3424-120-0x0000000004CD0000-0x0000000004D11000-memory.dmp
memory/3424-114-0x0000000000090000-0x0000000000091000-memory.dmp
memory/3424-118-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/3424-117-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/3424-116-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/3464-129-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3464-135-0x0000000005270000-0x0000000005271000-memory.dmp
memory/3464-190-0x0000000005870000-0x0000000005871000-memory.dmp
memory/3940-140-0x0000000004480000-0x0000000004481000-memory.dmp
memory/3940-149-0x00000000080D0000-0x00000000080D1000-memory.dmp
memory/3940-142-0x0000000006EB0000-0x0000000006EB1000-memory.dmp
memory/3940-143-0x00000000076A0000-0x00000000076A1000-memory.dmp
memory/3940-144-0x0000000007630000-0x0000000007631000-memory.dmp
memory/3940-145-0x00000000078B0000-0x00000000078B1000-memory.dmp
memory/3940-146-0x00000000043D0000-0x00000000043D1000-memory.dmp
memory/3940-147-0x00000000043D2000-0x00000000043D3000-memory.dmp
memory/3940-148-0x0000000007600000-0x0000000007601000-memory.dmp
memory/3940-141-0x0000000006F90000-0x0000000006F91000-memory.dmp
memory/3940-150-0x0000000007F60000-0x0000000007F61000-memory.dmp
memory/3940-158-0x0000000008F30000-0x0000000008F63000-memory.dmp
memory/3940-165-0x0000000008EF0000-0x0000000008EF1000-memory.dmp
memory/3940-170-0x0000000009060000-0x0000000009061000-memory.dmp
memory/3940-171-0x0000000009220000-0x0000000009221000-memory.dmp
memory/3940-172-0x000000007F770000-0x000000007F771000-memory.dmp
memory/3940-174-0x00000000043D3000-0x00000000043D4000-memory.dmp