Overview

overview

10

Static

static

SecuriteIn...79.exe

windows7_x64

3

SecuriteIn...79.exe

windows10_x64

10

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    14-12-2021 09:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe

  • Size

    1.0MB

  • MD5

    3d059df1a6a9edc0e20241113bd21c87

  • SHA1

    e8bcc9b32d15d45d1341f3589478ba87c2fd976d

  • SHA256

    dde5521f4b34414e6850fc869de027df46f3e4d5a1cb3cbb483c2900abe49c0d

  • SHA512

    07819f8b883c062a50b582805fe6886218e80e8e8d67ce91c4ee463e2a6b8579554352be030fc5ce0ebc8cb82000dd71fc5b85275f40ccdee915a9f5e154931b

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AiLQLqVXxoE.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:284
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AiLQLqVXxoE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp476C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1372
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe"
      2⤵
        PID:1148
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe"
        2⤵
          PID:1544
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe"
          2⤵
            PID:1100
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe"
            2⤵
              PID:588
            • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe
              "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979.exe"
              2⤵
                PID:728

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Credential Access

            Discovery

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp476C.tmp
              MD5

              2b05f02dc5da4df10ffa3cb1a8baf9d2

              SHA1

              d189d01e9cb04d9866a1589b14c4bca6d19023e1

              SHA256

              0e1cc854d614ee8e80e1a49c634b08c4593f0f7082a1d8da5c47a7c3dfe87430

              SHA512

              74a3dab8b398e750b9dc0877b7860a6a1b180471ab3411ee858a50302e46bffeb5d102fb987f9126bdf6129005b0814e0f765f560044961869f5d856a6ce91de

              Download Submit
            • memory/284-60-0x0000000000000000-mapping.dmp
              Download
            • memory/284-64-0x0000000002190000-0x0000000002191000-memory.dmp
              Filesize

              4KB

              Download
            • memory/284-66-0x0000000002192000-0x0000000002194000-memory.dmp
              Filesize

              8KB

              Download
            • memory/284-65-0x0000000002191000-0x0000000002192000-memory.dmp
              Filesize

              4KB

              Download
            • memory/832-54-0x0000000000350000-0x0000000000351000-memory.dmp
              Filesize

              4KB

              Download
            • memory/832-56-0x0000000076C91000-0x0000000076C93000-memory.dmp
              Filesize

              8KB

              Download
            • memory/832-57-0x0000000004D20000-0x0000000004D21000-memory.dmp
              Filesize

              4KB

              Download
            • memory/832-58-0x0000000000520000-0x0000000000528000-memory.dmp
              Filesize

              32KB

              Download
            • memory/832-59-0x00000000056D0000-0x00000000057E6000-memory.dmp
              Filesize

              1.1MB

              Download
            • memory/1372-61-0x0000000000000000-mapping.dmp
              Download