Analysis
-
max time kernel
162s -
max time network
169s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 03:33
Static task
static1
Behavioral task
behavioral1
Sample
01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe
Resource
win7-en-20211208
General
-
Target
01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe
-
Size
89KB
-
MD5
bd4d1f6a435639fc6f01af26237e0a31
-
SHA1
a5a65f759109f1876fc9b2c299fda3440bea3a49
-
SHA256
01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a
-
SHA512
72c748e698b854c61e8e8f8472cfc0b1701819d2abf5c71a79eef060812f45becefc217b8773e50642667e0bc2e74c9fd4ed8d1a2acff6e60ee2dca4cab90f89
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 1964 system.exe -
Drops startup file 1 IoCs
Processes:
01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mysystem.lnk 01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
system.exedescription pid process Token: SeDebugPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe Token: 33 1964 system.exe Token: SeIncBasePriorityPrivilege 1964 system.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exepid process 684 01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe 684 01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exedescription pid process target process PID 684 wrote to memory of 1964 684 01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe system.exe PID 684 wrote to memory of 1964 684 01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe system.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe"C:\Users\Admin\AppData\Local\Temp\01ab2c0cfb1e59c2664dceaed4dd0eb1549490c5670779b41a44a0f98e70a97a.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeMD5
22249eb9eda56570f33b44b2ad5f66d7
SHA1642d93447cfac014b556eebbc997890f09574172
SHA256ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81
SHA512e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1
-
C:\Users\Admin\AppData\Local\Temp\system.exeMD5
22249eb9eda56570f33b44b2ad5f66d7
SHA1642d93447cfac014b556eebbc997890f09574172
SHA256ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81
SHA512e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1
-
memory/684-115-0x00000000031D0000-0x00000000031D2000-memory.dmpFilesize
8KB
-
memory/684-118-0x00000000031D4000-0x00000000031D5000-memory.dmpFilesize
4KB
-
memory/684-117-0x00000000031D2000-0x00000000031D4000-memory.dmpFilesize
8KB
-
memory/684-119-0x00000000031D5000-0x00000000031D6000-memory.dmpFilesize
4KB
-
memory/684-120-0x00000000031D6000-0x00000000031D7000-memory.dmpFilesize
4KB
-
memory/684-121-0x00000000031D7000-0x00000000031D8000-memory.dmpFilesize
4KB
-
memory/684-126-0x00000000031DA000-0x00000000031DF000-memory.dmpFilesize
20KB
-
memory/684-125-0x00000000031D8000-0x00000000031DA000-memory.dmpFilesize
8KB
-
memory/1964-124-0x0000000002600000-0x0000000002602000-memory.dmpFilesize
8KB