5fa21d45a8b8150fa278d16bfd918344bbd3c102318d0e35b53d10a412b9e21d

Analysis

max time kernel
58s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
12/04/2022, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e910b3100b7625654adefa8b4ba3d4be.exe
Size 888KB
Sample220412-ppgegaeee4
SHA256 5fa21d45a8b8150fa278d16bfd918344bbd3c102318d0e35b53d10a412b9e21d
MD5 e910b3100b7625654adefa8b4ba3d4be
SHA1 b62c421f830e5eb1e19837e658e7aebf78efe51d
SHA512 102506b1ab386747ab7fa9f77e44127a3f69de34264ac60395eb5b87930087fade4b2371f9e7df47a1a7d6064075df7d6cdc7583f72a738f96d99e01ff556d5e
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1752	e910b3100b7625654adefa8b4ba3d4be.exe
1656	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	e910b3100b7625654adefa8b4ba3d4be.exe
Token: SeDebugPrivilege	1656	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1656	1752	e910b3100b7625654adefa8b4ba3d4be.exe	28
PID 1752 wrote to memory of 1656	1752	e910b3100b7625654adefa8b4ba3d4be.exe	28
PID 1752 wrote to memory of 1656	1752	e910b3100b7625654adefa8b4ba3d4be.exe	28
PID 1752 wrote to memory of 1656	1752	e910b3100b7625654adefa8b4ba3d4be.exe	28
PID 1752 wrote to memory of 1348	1752	e910b3100b7625654adefa8b4ba3d4be.exe	30
PID 1752 wrote to memory of 1348	1752	e910b3100b7625654adefa8b4ba3d4be.exe	30
PID 1752 wrote to memory of 1348	1752	e910b3100b7625654adefa8b4ba3d4be.exe	30
PID 1752 wrote to memory of 1348	1752	e910b3100b7625654adefa8b4ba3d4be.exe	30
PID 1752 wrote to memory of 332	1752	e910b3100b7625654adefa8b4ba3d4be.exe	32
PID 1752 wrote to memory of 332	1752	e910b3100b7625654adefa8b4ba3d4be.exe	32
PID 1752 wrote to memory of 332	1752	e910b3100b7625654adefa8b4ba3d4be.exe	32
PID 1752 wrote to memory of 332	1752	e910b3100b7625654adefa8b4ba3d4be.exe	32
PID 1752 wrote to memory of 576	1752	e910b3100b7625654adefa8b4ba3d4be.exe	33
PID 1752 wrote to memory of 576	1752	e910b3100b7625654adefa8b4ba3d4be.exe	33
PID 1752 wrote to memory of 576	1752	e910b3100b7625654adefa8b4ba3d4be.exe	33
PID 1752 wrote to memory of 576	1752	e910b3100b7625654adefa8b4ba3d4be.exe	33
PID 1752 wrote to memory of 524	1752	e910b3100b7625654adefa8b4ba3d4be.exe	34
PID 1752 wrote to memory of 524	1752	e910b3100b7625654adefa8b4ba3d4be.exe	34
PID 1752 wrote to memory of 524	1752	e910b3100b7625654adefa8b4ba3d4be.exe	34
PID 1752 wrote to memory of 524	1752	e910b3100b7625654adefa8b4ba3d4be.exe	34
PID 1752 wrote to memory of 320	1752	e910b3100b7625654adefa8b4ba3d4be.exe	35
PID 1752 wrote to memory of 320	1752	e910b3100b7625654adefa8b4ba3d4be.exe	35
PID 1752 wrote to memory of 320	1752	e910b3100b7625654adefa8b4ba3d4be.exe	35
PID 1752 wrote to memory of 320	1752	e910b3100b7625654adefa8b4ba3d4be.exe	35
PID 1752 wrote to memory of 1512	1752	e910b3100b7625654adefa8b4ba3d4be.exe	36
PID 1752 wrote to memory of 1512	1752	e910b3100b7625654adefa8b4ba3d4be.exe	36
PID 1752 wrote to memory of 1512	1752	e910b3100b7625654adefa8b4ba3d4be.exe	36
PID 1752 wrote to memory of 1512	1752	e910b3100b7625654adefa8b4ba3d4be.exe	36

C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe
"C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YYeFDSGuFwTDeb.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YYeFDSGuFwTDeb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA63F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1348
- C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe
  "C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe"
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe
  "C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe"
  2⤵
  PID:576
- C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe
  "C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe"
  2⤵
  PID:524
- C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe
  "C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe"
  2⤵
  PID:320
- C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe
  "C:\Users\Admin\AppData\Local\Temp\e910b3100b7625654adefa8b4ba3d4be.exe"
  2⤵
  PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpA63F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA63F.tmp
Size 1KB
SHA256 9902a7e8fcbe32cede1c46bb6bf8e5e227ee270b0f64224cb4a2e620cd7b219b
MD5 e9e62a2da221c8045ee8f42dbf5cc748
SHA1 32d6f94d5ce5d1ca863e08735193b693bdfb7b1e
SHA512 ca23f87fe53a083f361f4d87029f69fb1862eeeeca4e1cd48a9dae0a1144f0e0bf5f972571d2cb4adda8f1c02bccea7cc8cf37a9bb963061b5508d43d1c5d151
MD5 SHA1 SHA512

Submit Download

memory/1656-59-0x0000000075C11000-0x0000000075C13000-memory.dmp

Download

memory/1656-62-0x000000006F440000-0x000000006F9EB000-memory.dmp

Download

memory/1752-54-0x0000000000330000-0x0000000000414000-memory.dmp

Download

memory/1752-55-0x0000000000310000-0x000000000031E000-memory.dmp

Download

memory/1752-56-0x0000000005AE0000-0x0000000005B5E000-memory.dmp

Download

memory/1752-61-0x0000000005ED0000-0x0000000005F0A000-memory.dmp

Download