Analysis
-
max time kernel
177s -
max time network
196s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:46
Static task
static1
Behavioral task
behavioral1
Sample
98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exe
Resource
win7-en-20211208
General
-
Target
98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exe
-
Size
65KB
-
MD5
f68578468ff8fd930079871643277b9e
-
SHA1
d4d6b8ff3b9d8d5cec77c31a7e3abb745160f585
-
SHA256
98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577
-
SHA512
4565814af95661e8124859d41a528f0f99e25aa8b52e013b22f2dfafbb59116f46b8a344bbdceb401fa2e478fad7ad44f56ec65fc8aa3603c440ba7f207b2bea
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 2708 system.exe -
Drops startup file 1 IoCs
Processes:
98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mysystem.lnk 98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
system.exedescription pid process Token: SeDebugPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe Token: 33 2708 system.exe Token: SeIncBasePriorityPrivilege 2708 system.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exedescription pid process target process PID 3496 wrote to memory of 2708 3496 98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exe system.exe PID 3496 wrote to memory of 2708 3496 98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exe system.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exe"C:\Users\Admin\AppData\Local\Temp\98d7b9679073126fea9b73f9303c207ef14806da6b5f866a9ca1b6bd64fa5577.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeMD5
22249eb9eda56570f33b44b2ad5f66d7
SHA1642d93447cfac014b556eebbc997890f09574172
SHA256ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81
SHA512e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1
-
C:\Users\Admin\AppData\Local\Temp\system.exeMD5
22249eb9eda56570f33b44b2ad5f66d7
SHA1642d93447cfac014b556eebbc997890f09574172
SHA256ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81
SHA512e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1
-
memory/2708-122-0x0000000001690000-0x0000000001692000-memory.dmpFilesize
8KB
-
memory/3496-115-0x0000000001150000-0x0000000001152000-memory.dmpFilesize
8KB
-
memory/3496-117-0x0000000001152000-0x0000000001154000-memory.dmpFilesize
8KB
-
memory/3496-118-0x0000000001154000-0x0000000001155000-memory.dmpFilesize
4KB
-
memory/3496-119-0x0000000001155000-0x0000000001157000-memory.dmpFilesize
8KB