Overview
overview
10Static
static
101214e5f9de...98.exe
windows7_x64
101214e5f9de...98.exe
windows10_x64
7236020bb91...f6.exe
windows7_x64
10236020bb91...f6.exe
windows10_x64
1025dc70a3de...60.exe
windows7_x64
1025dc70a3de...60.exe
windows10_x64
1054de718b63...d9.exe
windows7_x64
154de718b63...d9.exe
windows10_x64
17ae9504811...a4.exe
windows7_x64
107ae9504811...a4.exe
windows10_x64
109c2554e79b...a0.exe
windows7_x64
109c2554e79b...a0.exe
windows10_x64
10a568f22004...3b.exe
windows7_x64
8a568f22004...3b.exe
windows10_x64
8aefd0c7794...37.exe
windows7_x64
10aefd0c7794...37.exe
windows10_x64
10d68b4d6cec...27.exe
windows7_x64
10d68b4d6cec...27.exe
windows10_x64
10Analysis
-
max time kernel
148s -
max time network
161s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08-07-2021 07:06
Behavioral task
behavioral1
Sample
1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe
Resource
win7v20210408
Behavioral task
behavioral14
Sample
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337.exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827.exe
Resource
win7v20210408
General
-
Target
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe
-
Size
83KB
-
MD5
4ed7de390496be3ec2ea7fdb3804282a
-
SHA1
2c919d469853fac9a7719f59407b395e8e360a49
-
SHA256
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b
-
SHA512
5716a8d9d86f9b1f1ad53f3fca96b5622b83ede56d370edc309a503263ad52b542b29e5d74810aed013e9f2e00b77b8c54d81aa0b43c77bfdf5bc7227251bd86
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Checker.exeSA_Checker.exepid process 1896 Checker.exe 2356 SA_Checker.exe -
Modifies Windows Firewall 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Checker.exepid process 1896 Checker.exe 1896 Checker.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SA_Checker.exepid process 2356 SA_Checker.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
SA_Checker.exedescription pid process Token: SeDebugPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe Token: 33 2356 SA_Checker.exe Token: SeIncBasePriorityPrivilege 2356 SA_Checker.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exeChecker.exeSA_Checker.exedescription pid process target process PID 2184 wrote to memory of 1896 2184 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe Checker.exe PID 2184 wrote to memory of 1896 2184 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe Checker.exe PID 2184 wrote to memory of 1896 2184 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe Checker.exe PID 2184 wrote to memory of 2356 2184 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe SA_Checker.exe PID 2184 wrote to memory of 2356 2184 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe SA_Checker.exe PID 2184 wrote to memory of 2356 2184 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe SA_Checker.exe PID 1896 wrote to memory of 2920 1896 Checker.exe cmd.exe PID 1896 wrote to memory of 2920 1896 Checker.exe cmd.exe PID 1896 wrote to memory of 2920 1896 Checker.exe cmd.exe PID 2356 wrote to memory of 2208 2356 SA_Checker.exe netsh.exe PID 2356 wrote to memory of 2208 2356 SA_Checker.exe netsh.exe PID 2356 wrote to memory of 2208 2356 SA_Checker.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe"C:\Users\Admin\AppData\Local\Temp\a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Checker.exe"C:\Users\Admin\AppData\Local\Temp\Checker.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵
-
C:\Users\Admin\AppData\Local\Temp\SA_Checker.exe"C:\Users\Admin\AppData\Local\Temp\SA_Checker.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\SA_Checker.exe" "SA_Checker.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Checker.exeMD5
970dbe61f878ffef5c98df482a33b93a
SHA12f8e4f7dd06cc67da661f7a33e6a6f79182bc957
SHA256bda3eaba6bd0015d68a261b9f8afd2431f702524b7a333fca3b3514058aaff48
SHA512f1c9b203e1770e3327217998b4a002a3494e61b8883b2ad4cb6439d3105b65c8cf807d77c029331b678df15dfc89bdff52bd93124b78c67d6f342fc48e2c8621
-
C:\Users\Admin\AppData\Local\Temp\Checker.exeMD5
970dbe61f878ffef5c98df482a33b93a
SHA12f8e4f7dd06cc67da661f7a33e6a6f79182bc957
SHA256bda3eaba6bd0015d68a261b9f8afd2431f702524b7a333fca3b3514058aaff48
SHA512f1c9b203e1770e3327217998b4a002a3494e61b8883b2ad4cb6439d3105b65c8cf807d77c029331b678df15dfc89bdff52bd93124b78c67d6f342fc48e2c8621
-
C:\Users\Admin\AppData\Local\Temp\SA_Checker.exeMD5
88949354d6430e1c6fd4ee0e0d987070
SHA110d1014f00cd173449f1d3ea2b698a5443688584
SHA256d08373a237b6f58a7b1215926fac0faefcdddbf7967b4226f84cbdb275a261f0
SHA5128a18883b2f89bc87449d9fde1ef835fba2186c494ffa3b2adcded7b86103ddd0154856dd5fa9b2e565b6bedd50b80975a8a07ac56560bc725c84c5d7d90abe29
-
C:\Users\Admin\AppData\Local\Temp\SA_Checker.exeMD5
88949354d6430e1c6fd4ee0e0d987070
SHA110d1014f00cd173449f1d3ea2b698a5443688584
SHA256d08373a237b6f58a7b1215926fac0faefcdddbf7967b4226f84cbdb275a261f0
SHA5128a18883b2f89bc87449d9fde1ef835fba2186c494ffa3b2adcded7b86103ddd0154856dd5fa9b2e565b6bedd50b80975a8a07ac56560bc725c84c5d7d90abe29
-
memory/1896-114-0x0000000000000000-mapping.dmp
-
memory/2208-122-0x0000000000000000-mapping.dmp
-
memory/2356-116-0x0000000000000000-mapping.dmp
-
memory/2356-119-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/2920-121-0x0000000000000000-mapping.dmp