f06b116d8af2db4ae345ed7c9596865c3476d401ff7d52b0a45478847f053ff1

Analysis

max time kernel
110s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
28-01-2022 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample13.exe
Size

37KB
MD5

2c7d4e78f74cc716f23492ad19daf763
SHA1

6ef7bfe52f66fb204b401aa7d280df124f3fa0e2
SHA256

f06b116d8af2db4ae345ed7c9596865c3476d401ff7d52b0a45478847f053ff1
SHA512

2e503be1721f52bffd2d426ed1fa24a7f8f412a78c15db4ec7fbff1df97622c3e1a540a1e1f45d4630faa8a7d5a565ba2cb9c4e713d3bc7a3e11cb50c9a613e8

Score

10^/10

logger

Malware Config

Signatures

Detect A310Logger 1 IoCs

Detect A310Logger SpyEx Variant.

logger

resource	yara_rule
behavioral2/memory/2836-117-0x0000000000340000-0x0000000000350000-memory.dmp	family_spyex

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
384	powershell.exe
3200	powershell.exe
908	powershell.exe
384	powershell.exe
908	powershell.exe
3200	powershell.exe
908	powershell.exe
384	powershell.exe
3200	powershell.exe
1912	powershell.exe
1912	powershell.exe
1912	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeIncreaseQuotaPrivilege	384	powershell.exe
Token: SeSecurityPrivilege	384	powershell.exe
Token: SeTakeOwnershipPrivilege	384	powershell.exe
Token: SeLoadDriverPrivilege	384	powershell.exe
Token: SeSystemProfilePrivilege	384	powershell.exe
Token: SeSystemtimePrivilege	384	powershell.exe
Token: SeProfSingleProcessPrivilege	384	powershell.exe
Token: SeIncBasePriorityPrivilege	384	powershell.exe
Token: SeCreatePagefilePrivilege	384	powershell.exe
Token: SeBackupPrivilege	384	powershell.exe
Token: SeRestorePrivilege	384	powershell.exe
Token: SeShutdownPrivilege	384	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeSystemEnvironmentPrivilege	384	powershell.exe
Token: SeRemoteShutdownPrivilege	384	powershell.exe
Token: SeUndockPrivilege	384	powershell.exe
Token: SeManageVolumePrivilege	384	powershell.exe
Token: 33	384	powershell.exe
Token: 34	384	powershell.exe
Token: 35	384	powershell.exe
Token: 36	384	powershell.exe
Token: SeIncreaseQuotaPrivilege	3200	powershell.exe
Token: SeSecurityPrivilege	3200	powershell.exe
Token: SeTakeOwnershipPrivilege	3200	powershell.exe
Token: SeLoadDriverPrivilege	3200	powershell.exe
Token: SeSystemProfilePrivilege	3200	powershell.exe
Token: SeSystemtimePrivilege	3200	powershell.exe
Token: SeProfSingleProcessPrivilege	3200	powershell.exe
Token: SeIncBasePriorityPrivilege	3200	powershell.exe
Token: SeCreatePagefilePrivilege	3200	powershell.exe
Token: SeBackupPrivilege	3200	powershell.exe
Token: SeRestorePrivilege	3200	powershell.exe
Token: SeShutdownPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeSystemEnvironmentPrivilege	3200	powershell.exe
Token: SeRemoteShutdownPrivilege	3200	powershell.exe
Token: SeUndockPrivilege	3200	powershell.exe
Token: SeManageVolumePrivilege	3200	powershell.exe
Token: 33	3200	powershell.exe
Token: 34	3200	powershell.exe
Token: 35	3200	powershell.exe
Token: 36	3200	powershell.exe
Token: SeIncreaseQuotaPrivilege	908	powershell.exe
Token: SeSecurityPrivilege	908	powershell.exe
Token: SeTakeOwnershipPrivilege	908	powershell.exe
Token: SeLoadDriverPrivilege	908	powershell.exe
Token: SeSystemProfilePrivilege	908	powershell.exe
Token: SeSystemtimePrivilege	908	powershell.exe
Token: SeProfSingleProcessPrivilege	908	powershell.exe
Token: SeIncBasePriorityPrivilege	908	powershell.exe
Token: SeCreatePagefilePrivilege	908	powershell.exe
Token: SeBackupPrivilege	908	powershell.exe
Token: SeRestorePrivilege	908	powershell.exe
Token: SeShutdownPrivilege	908	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeSystemEnvironmentPrivilege	908	powershell.exe
Token: SeRemoteShutdownPrivilege	908	powershell.exe
Token: SeUndockPrivilege	908	powershell.exe
Token: SeManageVolumePrivilege	908	powershell.exe
Token: 33	908	powershell.exe
Token: 34	908	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 908	2836	sample13.exe	70
PID 2836 wrote to memory of 908	2836	sample13.exe	70
PID 2836 wrote to memory of 908	2836	sample13.exe	70
PID 2836 wrote to memory of 3200	2836	sample13.exe	69
PID 2836 wrote to memory of 3200	2836	sample13.exe	69
PID 2836 wrote to memory of 3200	2836	sample13.exe	69
PID 2836 wrote to memory of 384	2836	sample13.exe	71
PID 2836 wrote to memory of 384	2836	sample13.exe	71
PID 2836 wrote to memory of 384	2836	sample13.exe	71
PID 2836 wrote to memory of 1912	2836	sample13.exe	76
PID 2836 wrote to memory of 1912	2836	sample13.exe	76
PID 2836 wrote to memory of 1912	2836	sample13.exe	76

C:\Users\Admin\AppData\Local\Temp\sample13.exe
"C:\Users\Admin\AppData\Local\Temp\sample13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.twitter.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-136-0x00000000075F0000-0x0000000007612000-memory.dmp

Filesize
136KB

Download
memory/384-132-0x00000000071C0000-0x00000000071C1000-memory.dmp

Filesize
4KB

Download
memory/384-163-0x00000000071C3000-0x00000000071C4000-memory.dmp

Filesize
4KB

Download
memory/384-133-0x00000000071C2000-0x00000000071C3000-memory.dmp

Filesize
4KB

Download
memory/384-157-0x0000000009520000-0x0000000009542000-memory.dmp

Filesize
136KB

Download
memory/384-155-0x00000000097F0000-0x0000000009884000-memory.dmp

Filesize
592KB

Download
memory/908-130-0x0000000003510000-0x0000000003536000-memory.dmp

Filesize
152KB

Download
memory/908-162-0x0000000003510000-0x0000000003536000-memory.dmp

Filesize
152KB

Download
memory/908-138-0x0000000007980000-0x00000000079E6000-memory.dmp

Filesize
408KB

Download
memory/908-139-0x0000000008350000-0x00000000086A0000-memory.dmp

Filesize
3.3MB

Download
memory/908-140-0x0000000008150000-0x000000000816C000-memory.dmp

Filesize
112KB

Download
memory/908-128-0x0000000004F40000-0x0000000004F76000-memory.dmp

Filesize
216KB

Download
memory/908-129-0x0000000007A80000-0x00000000080A8000-memory.dmp

Filesize
6.2MB

Download
memory/908-135-0x0000000003510000-0x0000000003536000-memory.dmp

Filesize
152KB

Download
memory/908-156-0x00000000098E0000-0x00000000098FA000-memory.dmp

Filesize
104KB

Download
memory/1912-311-0x0000000007890000-0x0000000007BE0000-memory.dmp

Filesize
3.3MB

Download
memory/1912-313-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/1912-344-0x0000000001173000-0x0000000001174000-memory.dmp

Filesize
4KB

Download
memory/1912-314-0x0000000001172000-0x0000000001173000-memory.dmp

Filesize
4KB

Download
memory/2836-120-0x0000000004B30000-0x000000000502E000-memory.dmp

Filesize
5.0MB

Download
memory/2836-121-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Filesize
40KB

Download
memory/2836-117-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2836-119-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Filesize
584KB

Download
memory/2836-118-0x0000000005030000-0x000000000552E000-memory.dmp

Filesize
5.0MB

Download
memory/2836-394-0x0000000004B30000-0x000000000502E000-memory.dmp

Filesize
5.0MB

Download
memory/3200-131-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/3200-142-0x0000000008240000-0x00000000082B6000-memory.dmp

Filesize
472KB

Download
memory/3200-141-0x00000000079B0000-0x00000000079FB000-memory.dmp

Filesize
300KB

Download
memory/3200-137-0x0000000007760000-0x00000000077C6000-memory.dmp

Filesize
408KB

Download
memory/3200-173-0x000000000A2B0000-0x000000000A928000-memory.dmp

Filesize
6.5MB

Download
memory/3200-164-0x00000000012E3000-0x00000000012E4000-memory.dmp

Filesize
4KB

Download
memory/3200-134-0x00000000012E2000-0x00000000012E3000-memory.dmp

Filesize
4KB

Download