6ef9af06422a0b2cc70ae23b0439edf9b8e950c91596087cd537d6435c9c85e4

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-en-20210916
submitted
17/09/2021, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0817afc9180089bbeb586f449ded2adf.exe
Size 317KB
Sample210917-e2jegshefr
SHA256 6ef9af06422a0b2cc70ae23b0439edf9b8e950c91596087cd537d6435c9c85e4
MD5 0817afc9180089bbeb586f449ded2adf
SHA1 e376032e8b1d79a7b1354dfe5fa482b585efc96f
SHA512 9174d207f0666b8149c730fdc9951814ca93be53a073eb893f5ee928c8b31d9b9fef3d7e241936cce23fb379d721baa50283508fa33dbeddbef4055381b95480
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
524	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
856	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 524	1376	0817afc9180089bbeb586f449ded2adf.exe	28
PID 1376 wrote to memory of 524	1376	0817afc9180089bbeb586f449ded2adf.exe	28
PID 1376 wrote to memory of 524	1376	0817afc9180089bbeb586f449ded2adf.exe	28
PID 1376 wrote to memory of 524	1376	0817afc9180089bbeb586f449ded2adf.exe	28
PID 524 wrote to memory of 856	524	cmd.exe	30
PID 524 wrote to memory of 856	524	cmd.exe	30
PID 524 wrote to memory of 856	524	cmd.exe	30
PID 524 wrote to memory of 856	524	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\0817afc9180089bbeb586f449ded2adf.exe
"C:\Users\Admin\AppData\Local\Temp\0817afc9180089bbeb586f449ded2adf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "0817afc9180089bbeb586f449ded2adf.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0817afc9180089bbeb586f449ded2adf.exe" & exit
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "0817afc9180089bbeb586f449ded2adf.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-53-0x0000000076911000-0x0000000076913000-memory.dmp

Download

memory/1376-54-0x00000000003B0000-0x00000000003F8000-memory.dmp

Download

memory/1376-55-0x0000000000400000-0x0000000000532000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads