Analysis
-
max time kernel
70s -
max time network
36s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-07-2021 21:07
Static task
static1
Behavioral task
behavioral1
Sample
0f65b4fa711b40e3c89a81fa69d8690f.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0f65b4fa711b40e3c89a81fa69d8690f.exe
Resource
win10v20210408
General
-
Target
0f65b4fa711b40e3c89a81fa69d8690f.exe
-
Size
16KB
-
MD5
0f65b4fa711b40e3c89a81fa69d8690f
-
SHA1
19240a26f205be2f8b4f4e00583a987e184f2875
-
SHA256
af18c1e923667ab287cd2699203e0bb6e6030dee131299ea670bc842dec76745
-
SHA512
82a3f01024ebf9c56c6f77d4c51003d3892e6da40a0efea34e08ddcca6786f3e3e7b6e2b18a95bf407c723a770f71e94eb90f68fb18726513a0dbac35b7e8f52
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 11 IoCs
Processes:
tmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exetmpEADBtmp.exepid process 1028 tmpEADBtmp.exe 996 tmpEADBtmp.exe 1160 tmpEADBtmp.exe 664 tmpEADBtmp.exe 1060 tmpEADBtmp.exe 616 tmpEADBtmp.exe 960 tmpEADBtmp.exe 1752 tmpEADBtmp.exe 1064 tmpEADBtmp.exe 1540 tmpEADBtmp.exe 1104 tmpEADBtmp.exe -
Loads dropped DLL 10 IoCs
Processes:
tmpEADBtmp.exepid process 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
tmpEADBtmp.exepid process 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe 1028 tmpEADBtmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0f65b4fa711b40e3c89a81fa69d8690f.exetmpEADBtmp.exedescription pid process Token: SeDebugPrivilege 1652 0f65b4fa711b40e3c89a81fa69d8690f.exe Token: SeDebugPrivilege 1028 tmpEADBtmp.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
0f65b4fa711b40e3c89a81fa69d8690f.exetmpEADBtmp.exedescription pid process target process PID 1652 wrote to memory of 1028 1652 0f65b4fa711b40e3c89a81fa69d8690f.exe tmpEADBtmp.exe PID 1652 wrote to memory of 1028 1652 0f65b4fa711b40e3c89a81fa69d8690f.exe tmpEADBtmp.exe PID 1652 wrote to memory of 1028 1652 0f65b4fa711b40e3c89a81fa69d8690f.exe tmpEADBtmp.exe PID 1652 wrote to memory of 1028 1652 0f65b4fa711b40e3c89a81fa69d8690f.exe tmpEADBtmp.exe PID 1028 wrote to memory of 996 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 996 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 996 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 996 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1160 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1160 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1160 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1160 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 664 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 664 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 664 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 664 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1060 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1060 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1060 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1060 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 616 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 616 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 616 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 616 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 960 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 960 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 960 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 960 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1752 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1752 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1752 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1752 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1064 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1064 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1064 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1064 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1540 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1540 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1540 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1540 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1104 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1104 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1104 1028 tmpEADBtmp.exe tmpEADBtmp.exe PID 1028 wrote to memory of 1104 1028 tmpEADBtmp.exe tmpEADBtmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f65b4fa711b40e3c89a81fa69d8690f.exe"C:\Users\Admin\AppData\Local\Temp\0f65b4fa711b40e3c89a81fa69d8690f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeC:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
C:\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
\Users\Admin\AppData\Local\Temp\tmpEADBtmp.exeMD5
d572da9202196121d952231f26d65d07
SHA18934580e7ee3f3852e159298769bdd38bcaa12a0
SHA25615337a846c1e262136124361b3624ddd3519cf3c7f93aba1ed75728a482fc662
SHA512de311f400e980d5fc987d6a5262057823b9dc3f9e7930623fab16c9954977949b3b0901de136548db1f3a7b5d864dad2738c791d511241ce4e49e8d83f7dea5a
-
memory/1028-69-0x0000000004ED5000-0x0000000004EE6000-memory.dmpFilesize
68KB
-
memory/1028-68-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/1028-70-0x0000000005DB0000-0x0000000005FB9000-memory.dmpFilesize
2.0MB
-
memory/1028-66-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1028-75-0x00000000021B0000-0x0000000002225000-memory.dmpFilesize
468KB
-
memory/1028-63-0x0000000000000000-mapping.dmp
-
memory/1652-60-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/1652-62-0x000000001B030000-0x000000001B032000-memory.dmpFilesize
8KB