85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a

Analysis

max time kernel
96s
max time network
85s
platform
windows7_x64
resource
win7v20210408
submitted
20/09/2021, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6200b9b9789794de4a8d78f4ae96d22.exe
Size 292KB
Sample210920-pl66qaggdk
SHA256 85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
MD5 f6200b9b9789794de4a8d78f4ae96d22
SHA1 1d18c71e7e4de5c6216653db5effba586345597c
SHA512 5fd2e93293bf2ebe5b68e747dbed842c2f4fcd74dce883ffa7daa6daf647e41f4b1926fdf2f05048b3024609ef6805fb2a6b501c92335ab37098dfb6d4defa72
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1536	powershell.exe
1640	powershell.exe
1640	powershell.exe
1536	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeIncreaseQuotaPrivilege	1640	powershell.exe
Token: SeSecurityPrivilege	1640	powershell.exe
Token: SeTakeOwnershipPrivilege	1640	powershell.exe
Token: SeLoadDriverPrivilege	1640	powershell.exe
Token: SeSystemProfilePrivilege	1640	powershell.exe
Token: SeSystemtimePrivilege	1640	powershell.exe
Token: SeProfSingleProcessPrivilege	1640	powershell.exe
Token: SeIncBasePriorityPrivilege	1640	powershell.exe
Token: SeCreatePagefilePrivilege	1640	powershell.exe
Token: SeBackupPrivilege	1640	powershell.exe
Token: SeRestorePrivilege	1640	powershell.exe
Token: SeShutdownPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeSystemEnvironmentPrivilege	1640	powershell.exe
Token: SeRemoteShutdownPrivilege	1640	powershell.exe
Token: SeUndockPrivilege	1640	powershell.exe
Token: SeManageVolumePrivilege	1640	powershell.exe
Token: 33	1640	powershell.exe
Token: 34	1640	powershell.exe
Token: 35	1640	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe
Token: SeManageVolumePrivilege	1536	powershell.exe
Token: 33	1536	powershell.exe
Token: 34	1536	powershell.exe
Token: 35	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1640	powershell.exe
Token: SeSecurityPrivilege	1640	powershell.exe
Token: SeTakeOwnershipPrivilege	1640	powershell.exe
Token: SeLoadDriverPrivilege	1640	powershell.exe
Token: SeSystemProfilePrivilege	1640	powershell.exe
Token: SeSystemtimePrivilege	1640	powershell.exe
Token: SeProfSingleProcessPrivilege	1640	powershell.exe
Token: SeIncBasePriorityPrivilege	1640	powershell.exe
Token: SeCreatePagefilePrivilege	1640	powershell.exe
Token: SeBackupPrivilege	1640	powershell.exe
Token: SeRestorePrivilege	1640	powershell.exe
Token: SeShutdownPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeSystemEnvironmentPrivilege	1640	powershell.exe
Token: SeRemoteShutdownPrivilege	1640	powershell.exe
Token: SeUndockPrivilege	1640	powershell.exe
Token: SeManageVolumePrivilege	1640	powershell.exe
Token: 33	1640	powershell.exe
Token: 34	1640	powershell.exe
Token: 35	1640	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1640	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	27
PID 2000 wrote to memory of 1640	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	27
PID 2000 wrote to memory of 1640	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	27
PID 2000 wrote to memory of 1640	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	27
PID 2000 wrote to memory of 1536	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	28
PID 2000 wrote to memory of 1536	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	28
PID 2000 wrote to memory of 1536	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	28
PID 2000 wrote to memory of 1536	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	28
PID 2000 wrote to memory of 1948	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	31
PID 2000 wrote to memory of 1948	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	31
PID 2000 wrote to memory of 1948	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	31
PID 2000 wrote to memory of 1948	2000	f6200b9b9789794de4a8d78f4ae96d22.exe	31

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com
  2⤵
  PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-93-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/1536-76-0x00000000047F0000-0x00000000047F1000-memory.dmp

Download

memory/1536-88-0x0000000005650000-0x0000000005651000-memory.dmp

Download

memory/1536-73-0x00000000047B0000-0x00000000047B1000-memory.dmp

Download

memory/1536-94-0x00000000061D0000-0x00000000061D1000-memory.dmp

Download

memory/1536-95-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/1536-102-0x0000000006280000-0x0000000006281000-memory.dmp

Download

memory/1536-80-0x00000000047B2000-0x00000000047B3000-memory.dmp

Download

memory/1640-70-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/1640-81-0x00000000048B2000-0x00000000048B3000-memory.dmp

Download

memory/1640-82-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/1640-74-0x00000000048B0000-0x00000000048B1000-memory.dmp

Download

memory/1640-84-0x0000000004850000-0x0000000004851000-memory.dmp

Download

memory/1640-114-0x0000000006320000-0x0000000006321000-memory.dmp

Download

memory/1948-75-0x0000000001F50000-0x0000000001F51000-memory.dmp

Download

memory/1948-79-0x0000000001F52000-0x0000000001F53000-memory.dmp

Download

memory/1948-66-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/2000-60-0x00000000000B0000-0x00000000000B1000-memory.dmp

Download

memory/2000-62-0x00000000004E0000-0x00000000004E1000-memory.dmp

Download