Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-06-2021 00:33
Static task
static1
Behavioral task
behavioral1
Sample
2f03f812c5df758e332a6978022f0820.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2f03f812c5df758e332a6978022f0820.exe
Resource
win10v20210408
General
-
Target
2f03f812c5df758e332a6978022f0820.exe
-
Size
1.2MB
-
MD5
2f03f812c5df758e332a6978022f0820
-
SHA1
852515886d60cdb1171833b21a2d22e3e4120744
-
SHA256
7c30dae34afc93b726cb4fa4b1a658921a29a7de38a21ceb50c6add38fae0ce4
-
SHA512
f16f1dd59c14ce09a21e0576689f20f42901caa5f59a6d704113c7172d31221187670fce7a34fada4c5310c69628aab1bff3dfafef5aa7d3cdd8edaf961d4c06
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1860-126-0x0000000000400000-0x00000000004F6000-memory.dmp upx behavioral2/memory/1860-128-0x0000000000400000-0x00000000004F6000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2f03f812c5df758e332a6978022f0820.exedescription pid process target process PID 664 set thread context of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
2f03f812c5df758e332a6978022f0820.exepid process 664 2f03f812c5df758e332a6978022f0820.exe 664 2f03f812c5df758e332a6978022f0820.exe 664 2f03f812c5df758e332a6978022f0820.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2f03f812c5df758e332a6978022f0820.exepid process 1860 2f03f812c5df758e332a6978022f0820.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2f03f812c5df758e332a6978022f0820.exe2f03f812c5df758e332a6978022f0820.exedescription pid process Token: SeDebugPrivilege 664 2f03f812c5df758e332a6978022f0820.exe Token: SeShutdownPrivilege 1860 2f03f812c5df758e332a6978022f0820.exe Token: SeCreatePagefilePrivilege 1860 2f03f812c5df758e332a6978022f0820.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2f03f812c5df758e332a6978022f0820.exe2f03f812c5df758e332a6978022f0820.exedescription pid process target process PID 664 wrote to memory of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe PID 664 wrote to memory of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe PID 664 wrote to memory of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe PID 664 wrote to memory of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe PID 664 wrote to memory of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe PID 664 wrote to memory of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe PID 664 wrote to memory of 1860 664 2f03f812c5df758e332a6978022f0820.exe 2f03f812c5df758e332a6978022f0820.exe PID 1860 wrote to memory of 796 1860 2f03f812c5df758e332a6978022f0820.exe cmd.exe PID 1860 wrote to memory of 796 1860 2f03f812c5df758e332a6978022f0820.exe cmd.exe PID 1860 wrote to memory of 796 1860 2f03f812c5df758e332a6978022f0820.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f03f812c5df758e332a6978022f0820.exe"C:\Users\Admin\AppData\Local\Temp\2f03f812c5df758e332a6978022f0820.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f03f812c5df758e332a6978022f0820.exe"C:\Users\Admin\AppData\Local\Temp\2f03f812c5df758e332a6978022f0820.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7K4sf085Np455DaH.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7K4sf085Np455DaH.batMD5
35ba658f91e67b854262c81bea2f84b4
SHA19ac44ce92ea1dccd598f69d1b166f2b213edce1c
SHA25693d92b1994e2d739bbd68817fdf3eada05d3577600e8e2844e58c0c59042370c
SHA512ab71e7a663500f22fc244dd71e6a10083975d9f091a20730fad7e9729eee8a42e7050121087726d825dcd7723302f9ea940922f847030f1c5bbb68f4744fcf11
-
memory/664-123-0x000000000AF90000-0x000000000AFA6000-memory.dmpFilesize
88KB
-
memory/664-124-0x0000000005300000-0x00000000053B5000-memory.dmpFilesize
724KB
-
memory/664-118-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/664-119-0x000000000AFC0000-0x000000000AFC1000-memory.dmpFilesize
4KB
-
memory/664-120-0x000000000AB60000-0x000000000AB61000-memory.dmpFilesize
4KB
-
memory/664-121-0x000000000AAD0000-0x000000000AAD1000-memory.dmpFilesize
4KB
-
memory/664-117-0x000000000AA20000-0x000000000AA21000-memory.dmpFilesize
4KB
-
memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/664-122-0x000000000ACC0000-0x000000000ACC1000-memory.dmpFilesize
4KB
-
memory/664-125-0x0000000005500000-0x0000000005575000-memory.dmpFilesize
468KB
-
memory/664-116-0x0000000005110000-0x00000000051B9000-memory.dmpFilesize
676KB
-
memory/796-129-0x0000000000000000-mapping.dmp
-
memory/1860-126-0x0000000000400000-0x00000000004F6000-memory.dmpFilesize
984KB
-
memory/1860-128-0x0000000000400000-0x00000000004F6000-memory.dmpFilesize
984KB
-
memory/1860-127-0x00000000004F4AC0-mapping.dmp