Analysis
- max time kernel
121s - max time network
124s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
31/10/2021, 22:59
General
- Target 109077a96c1ead8960970373eb739501.exe
- Size 3.8MB
- Sample211031-2ydfdsgee2
- SHA256 b396f55b0cb17ada2fd582e0dfd39feca81ba7466c7d01cbfb19d2229a3b2993
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\109077a96c1ead8960970373eb739501.exe"C:\Users\Admin\AppData\Local\Temp\109077a96c1ead8960970373eb739501.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unintroductive.exe"C:\Users\Admin\AppData\Local\Temp\Unintroductive.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/612-54-0x0000000075821000-0x0000000075823000-memory.dmp
memory/1112-60-0x0000000001230000-0x0000000001231000-memory.dmp
memory/1112-62-0x000000001C3A0000-0x000000001C6D9000-memory.dmp
memory/1112-63-0x000000001BDF0000-0x000000001BDF2000-memory.dmp
memory/1112-64-0x000000001BDF6000-0x000000001BE15000-memory.dmp
memory/1112-65-0x000000001AFA0000-0x000000001B2CC000-memory.dmp
memory/1112-66-0x0000000022DB0000-0x0000000023019000-memory.dmp
memory/1112-67-0x000000001BE15000-0x000000001BE16000-memory.dmp