Analysis
-
max time kernel
70s -
max time network
44s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-07-2021 16:45
Static task
static1
Behavioral task
behavioral1
Sample
be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
Resource
win10v20210408
General
-
Target
be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
-
Size
807KB
-
MD5
1032e6ffdbb406b3ee80d7c50989e2b5
-
SHA1
fb63c770ba76d25f181be481acef62aa2cf5f82c
-
SHA256
be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f
-
SHA512
bd5203164dd2a966c1db164f6d472615932a673d7be6105c5c36a130e1bb7582e4a9a479833ecbc102c36a5786ef1e459b8eec944beb8cdf51c763078a2923f3
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exepid process 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exedescription pid process Token: SeDebugPrivilege 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exedescription pid process target process PID 736 wrote to memory of 656 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe schtasks.exe PID 736 wrote to memory of 656 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe schtasks.exe PID 736 wrote to memory of 656 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe schtasks.exe PID 736 wrote to memory of 656 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe schtasks.exe PID 736 wrote to memory of 1664 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1664 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1664 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1664 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1456 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1456 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1456 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1456 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 524 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 524 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 524 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 524 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1868 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1868 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1868 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 1868 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 808 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 808 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 808 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe PID 736 wrote to memory of 808 736 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe"C:\Users\Admin\AppData\Local\Temp\be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GrxeqzFZZljX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp909C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp909C.tmpMD5
551e4867c804267ae628031d0cf8d744
SHA15232905667b05c261df6c2e143e3e8823bafdc96
SHA25641ec101e560e90a1fffb39511abc9e3484f0e878c8e9190fb25206fd99611774
SHA512c5865afd45e09c197a541f1d6260705fe927e20feb3517c95eda4ce986bcd6d52767bff3c936f6afba5369a513cc150e2623117c52cec45f35c4ba417bb902b7
-
memory/656-66-0x0000000000000000-mapping.dmp
-
memory/736-60-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/736-62-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/736-63-0x0000000009DD0000-0x000000000BDCF000-memory.dmpFilesize
32.0MB
-
memory/736-64-0x0000000005170000-0x00000000051D7000-memory.dmpFilesize
412KB
-
memory/736-65-0x0000000000620000-0x000000000064C000-memory.dmpFilesize
176KB