Analysis
- max time kernel
107s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
31/10/2021, 22:59
General
- Target 109077a96c1ead8960970373eb739501.exe
- Size 3.8MB
- Sample211031-2ydfdsgee2
- SHA256 b396f55b0cb17ada2fd582e0dfd39feca81ba7466c7d01cbfb19d2229a3b2993
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\109077a96c1ead8960970373eb739501.exe"C:\Users\Admin\AppData\Local\Temp\109077a96c1ead8960970373eb739501.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unintroductive.exe"C:\Users\Admin\AppData\Local\Temp\Unintroductive.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/724-118-0x000001C7D6740000-0x000001C7D6741000-memory.dmp
memory/724-120-0x000001C7F1070000-0x000001C7F13A9000-memory.dmp
memory/724-121-0x000001C7D6EC0000-0x000001C7D6EC2000-memory.dmp
memory/724-122-0x000001C7D6EC2000-0x000001C7D6EC4000-memory.dmp
memory/724-123-0x000001C7D6EC4000-0x000001C7D6EC6000-memory.dmp
memory/724-124-0x000001C7F43D0000-0x000001C7F46FC000-memory.dmp
memory/724-125-0x000001C7F4700000-0x000001C7F4969000-memory.dmp
memory/724-126-0x000001C7F4E40000-0x000001C7F4E41000-memory.dmp
memory/724-127-0x000001C7F4990000-0x000001C7F4991000-memory.dmp