Analysis
-
max time kernel
237s -
max time network
1566s -
submitted
01-01-1970 00:00
General
-
Target
setup_installer/Wed09c42cad92c20f79.exe
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09c42cad92c20f79.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09c42cad92c20f79.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Wed09c42cad92c20f79.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09c42cad92c20f79.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Wed09c42cad92c20f79.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-118-0x0000000000000000-mapping.dmp
-
memory/716-119-0x0000000000000000-mapping.dmp
-
memory/1900-116-0x0000000002DC0000-0x0000000002E0A000-memory.dmpFilesize
296KB
-
memory/1900-117-0x0000000000400000-0x0000000002BC3000-memory.dmpFilesize
39.8MB