Analysis
- max time kernel
4264966s - max time network
16s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/01/2022, 09:28
General
- Target Zsd~reet_02987635367-03987635637.exe
- Size 787KB
- Sample220117-lfchdahebk
- SHA256 d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zsd~reet_02987635367-03987635637.exe"C:\Users\Admin\AppData\Local\Temp\Zsd~reet_02987635367-03987635637.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2416-133-0x0000000000150000-0x000000000021A000-memory.dmp
memory/2416-134-0x0000000000150000-0x000000000021A000-memory.dmp
memory/2416-135-0x0000000004A30000-0x0000000004ACC000-memory.dmp
memory/2416-136-0x0000000005080000-0x0000000005624000-memory.dmp
memory/2416-137-0x0000000004B70000-0x0000000004C02000-memory.dmp
memory/2416-138-0x0000000004AD0000-0x0000000005074000-memory.dmp
memory/2416-139-0x0000000004D70000-0x0000000004D7A000-memory.dmp