Analysis
-
max time kernel
159s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 01:30
Static task
static1
Behavioral task
behavioral1
Sample
5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6.ps1
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6.ps1
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6.ps1
-
Size
911KB
-
MD5
0d890fc8e761b764ba3a04af07197e20
-
SHA1
21c0ed7abaafbfd14c777aa370f397e4351654a6
-
SHA256
5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6
-
SHA512
87416be9fb11ef9d9eacc9df822e0f31f7d6908688972cabe9824599c34420c1e8cae2d7eca278dbba2acb4341761db810504d414438aa5c4631950bb1afcd64
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\RepairEdit.tiff Explorer.EXE File opened for modification C:\Users\Admin\Pictures\TestPing.tiff Explorer.EXE -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5A.BDR Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD.XML Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV Explorer.EXE File opened for modification C:\Program Files\ProtectStep.vsw Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143744.GIF Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Module.thmx Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo Explorer.EXE File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\et.pak Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLINACC.XML Explorer.EXE File opened for modification C:\Program Files\Windows Journal\Templates\Memo.jtp Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN002.XML Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\ROGERS.COM.XML Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199727.WMF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL107.XML Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\EquityFax.Dotx Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.JPG Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Author2String.XSL Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10336_.GIF Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSO0127.ACL Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPORT.CFG Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL020.XML Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0185604.WMF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM Explorer.EXE File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02082_.GIF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15073_.GIF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02039_.GIF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG Explorer.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\YEAR.XSL Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10254_.GIF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterApplicationDescriptors.xml Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18245_.WMF Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx Explorer.EXE File opened for modification C:\Program Files\ApproveSplit.asx Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB8.BDR Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialResume.dotx Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf Explorer.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h Explorer.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1540 powershell.exe 1540 powershell.exe 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE 1416 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1540 powershell.exe Token: SeDebugPrivilege 1416 Explorer.EXE Token: SeImpersonatePrivilege 1416 Explorer.EXE Token: SeBackupPrivilege 1088 vssvc.exe Token: SeRestorePrivilege 1088 vssvc.exe Token: SeAuditPrivilege 1088 vssvc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1540 wrote to memory of 572 1540 powershell.exe 28 PID 1540 wrote to memory of 572 1540 powershell.exe 28 PID 1540 wrote to memory of 572 1540 powershell.exe 28 PID 572 wrote to memory of 1368 572 csc.exe 29 PID 572 wrote to memory of 1368 572 csc.exe 29 PID 572 wrote to memory of 1368 572 csc.exe 29 PID 1540 wrote to memory of 592 1540 powershell.exe 30 PID 1540 wrote to memory of 592 1540 powershell.exe 30 PID 1540 wrote to memory of 592 1540 powershell.exe 30 PID 592 wrote to memory of 1708 592 csc.exe 31 PID 592 wrote to memory of 1708 592 csc.exe 31 PID 592 wrote to memory of 1708 592 csc.exe 31 PID 1540 wrote to memory of 1416 1540 powershell.exe 15
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1s1zlq1v.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8038.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8037.tmp"4⤵PID:1368
-
-
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n7ocqjge.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES822C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC822B.tmp"4⤵PID:1708
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088