686d56d6a2903bf7b2f9710f308046a91f5f9082db14a7470f93a59e9939ec4c

Analysis

max time kernel
4294194s
max time network
151s
platform
windows7_x64
resource
win7-20220223-en
submitted
09/03/2022, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01.exe
Size 108KB
Sample220309-pff3cabcbq
SHA256 686d56d6a2903bf7b2f9710f308046a91f5f9082db14a7470f93a59e9939ec4c
MD5 829775bde5f5559e2948224d8a4e5ef9
SHA1 6630a7aaafcb5bc47240ebdbb4233abf5f353ca8
SHA512 6941bdc72c90c928d7d0f20350154fd5c4fbe750f3b6420e6d70944a79882dd8349c6bc7ae51df318e881a33b8987de159602f5f7c7c65438734d5073dbf26a7
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rptkz1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xagskcisl1\\Rptkz1.exe\""	01.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 1488	1104	01.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
752	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1572	powershell.exe
1104	01.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	01.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1488	01.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 948	1104	01.exe	27
PID 1104 wrote to memory of 948	1104	01.exe	27
PID 1104 wrote to memory of 948	1104	01.exe	27
PID 1104 wrote to memory of 948	1104	01.exe	27
PID 948 wrote to memory of 752	948	cmd.exe	29
PID 948 wrote to memory of 752	948	cmd.exe	29
PID 948 wrote to memory of 752	948	cmd.exe	29
PID 948 wrote to memory of 752	948	cmd.exe	29
PID 1104 wrote to memory of 1572	1104	01.exe	32
PID 1104 wrote to memory of 1572	1104	01.exe	32
PID 1104 wrote to memory of 1572	1104	01.exe	32
PID 1104 wrote to memory of 1572	1104	01.exe	32
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34
PID 1104 wrote to memory of 1488	1104	01.exe	34

C:\Users\Admin\AppData\Local\Temp\01.exe
"C:\Users\Admin\AppData\Local\Temp\01.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 19
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\timeout.exe
    timeout 19
    3⤵
    - Delays execution with timeout.exe
    PID:752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABYAGEAZwBzAGsAYwBpAHMAbAAxAFwAUgBwAHQAawB6ADEALgBlAHgAZQAnAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Users\Admin\AppData\Local\Temp\01.exe
  C:\Users\Admin\AppData\Local\Temp\01.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-54-0x0000000000DD0000-0x0000000000DF2000-memory.dmp

Download

memory/1104-55-0x0000000074370000-0x0000000074A5E000-memory.dmp

Download

memory/1104-56-0x0000000074FF1000-0x0000000074FF3000-memory.dmp

Download

memory/1104-57-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/1104-58-0x0000000005C20000-0x0000000005CB8000-memory.dmp

Download

memory/1104-59-0x0000000005E50000-0x0000000005ECE000-memory.dmp

Download

memory/1104-60-0x0000000004F40000-0x0000000004F8C000-memory.dmp

Download

memory/1488-73-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1488-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1488-80-0x0000000073C80000-0x000000007436E000-memory.dmp

Download

memory/1488-81-0x0000000005410000-0x0000000005411000-memory.dmp

Download

memory/1488-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1488-67-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1488-69-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1488-71-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1488-75-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1572-62-0x000000006EE30000-0x000000006F3DB000-memory.dmp

Download

memory/1572-63-0x0000000002480000-0x00000000030CA000-memory.dmp

Download

memory/1572-66-0x0000000002480000-0x00000000030CA000-memory.dmp

Download

memory/1572-65-0x0000000002480000-0x00000000030CA000-memory.dmp

Download

memory/1572-64-0x000000006EE30000-0x000000006F3DB000-memory.dmp

Download