Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en -
submitted
14-09-2021 23:26
Static task
static1
Behavioral task
behavioral1
Sample
adobe1.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
adobe1.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
adobe1.exe
-
Size
575KB
-
MD5
fa0469c74632450ff280cda736e3b589
-
SHA1
2a125739fc91b38f69c021d8c1e9f66f15da7c1b
-
SHA256
9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9
-
SHA512
291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/812-53-0x0000000013140000-0x000000001338D000-memory.dmp upx behavioral1/memory/812-56-0x0000000013140000-0x000000001338D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
adobe1.exedescription pid process target process PID 736 set thread context of 812 736 adobe1.exe adobe1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
adobe1.exeadobe1.exedescription pid process target process PID 736 wrote to memory of 812 736 adobe1.exe adobe1.exe PID 736 wrote to memory of 812 736 adobe1.exe adobe1.exe PID 736 wrote to memory of 812 736 adobe1.exe adobe1.exe PID 736 wrote to memory of 812 736 adobe1.exe adobe1.exe PID 736 wrote to memory of 812 736 adobe1.exe adobe1.exe PID 736 wrote to memory of 812 736 adobe1.exe adobe1.exe PID 812 wrote to memory of 1012 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1012 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1012 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1012 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1012 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1120 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1120 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1120 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1120 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 1120 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 948 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 948 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 948 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 948 812 adobe1.exe iexplore.exe PID 812 wrote to memory of 948 812 adobe1.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exe"C:\Users\Admin\AppData\Local\Temp\adobe1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exe"C:\Users\Admin\AppData\Local\Temp\adobe1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/736-52-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/812-53-0x0000000013140000-0x000000001338D000-memory.dmpFilesize
2.3MB
-
memory/812-54-0x000000001338B560-mapping.dmp
-
memory/812-55-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/812-56-0x0000000013140000-0x000000001338D000-memory.dmpFilesize
2.3MB