Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 13:43
Static task
static1
Behavioral task
behavioral1
Sample
bank TT slip.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
bank TT slip.exe
Resource
win10-en-20210920
General
-
Target
bank TT slip.exe
-
Size
922KB
-
MD5
f92972c4d6cb28b350e6fa0ce897ebf2
-
SHA1
edb8413f28ccda47f892f0ecdb85d80f5412cd93
-
SHA256
c3e1fb98c978c699c79b569c14c7bc41fce17a1846e9d66757ad579e3c97ceda
-
SHA512
0d761dac89dba988763cb86bf756f0ea17f3e2eee1badf545491bb8b56090a955e0b6b10c11835638256ac7cb69c73e2ca489db35480271bc7f3c90e4e5e4ccb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
bank TT slip.exepid process 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe 1064 bank TT slip.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bank TT slip.exedescription pid process Token: SeDebugPrivilege 1064 bank TT slip.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
bank TT slip.exedescription pid process target process PID 1064 wrote to memory of 1852 1064 bank TT slip.exe schtasks.exe PID 1064 wrote to memory of 1852 1064 bank TT slip.exe schtasks.exe PID 1064 wrote to memory of 1852 1064 bank TT slip.exe schtasks.exe PID 1064 wrote to memory of 1852 1064 bank TT slip.exe schtasks.exe PID 1064 wrote to memory of 1372 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 1372 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 1372 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 1372 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 932 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 932 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 932 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 932 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 864 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 864 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 864 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 864 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 408 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 408 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 408 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 408 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 812 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 812 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 812 1064 bank TT slip.exe bank TT slip.exe PID 1064 wrote to memory of 812 1064 bank TT slip.exe bank TT slip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bank TT slip.exe"C:\Users\Admin\AppData\Local\Temp\bank TT slip.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fzoFhfGhuG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6680.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\bank TT slip.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\bank TT slip.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\bank TT slip.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\bank TT slip.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\bank TT slip.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6680.tmpMD5
e153b2fb476e57b7030a797778b91396
SHA1b4285201dd40f37779402f913f3836c530733bc2
SHA25685f46bd8e348306cd4bef8773625deca8b23b30114047a4245c2745ae43cfa64
SHA512dd19dbcb529fbd638e7b8de7fc62110c2fcd30d5c042054dea85e33773713c370dd1d08a6efb3f3d96acf04585aa1bee22934736103e658b1da5e46643d0c69d
-
memory/1064-55-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1064-57-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB
-
memory/1064-58-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/1064-59-0x0000000000520000-0x000000000052E000-memory.dmpFilesize
56KB
-
memory/1064-60-0x0000000005C50000-0x0000000005CD0000-memory.dmpFilesize
512KB
-
memory/1064-61-0x0000000000620000-0x0000000000658000-memory.dmpFilesize
224KB
-
memory/1852-62-0x0000000000000000-mapping.dmp