770baec4d4ea7b2b87c117cf09c9b5b3263e827b8d449b35a35a9e03aac6d362

Analysis

max time kernel
4294201s
max time network
146s
platform
windows7_x64
resource
win7-20220311-en
submitted
14/04/2022, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d21bc523c99c10eabde472f8315b1348.exe
Size 12KB
Sample220414-n2vxysaec8
SHA256 770baec4d4ea7b2b87c117cf09c9b5b3263e827b8d449b35a35a9e03aac6d362
MD5 d21bc523c99c10eabde472f8315b1348
SHA1 7813379f5f945bafe61747ef7f082dbff48b1f1d
SHA512 af0bffe06798dd039a477c2cd7f0cb7f159bfc6b0e52d692390e43fe781d4a9a7ca160ac4fc4aadd4e859f2eb8b8874ff2b28c1f515d1b5931b27f939ba22ef2
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1732	timeout.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1956	d21bc523c99c10eabde472f8315b1348.exe
1956	d21bc523c99c10eabde472f8315b1348.exe
2032	MSBuild.exe
2032	MSBuild.exe
2032	MSBuild.exe
2032	MSBuild.exe
2032	MSBuild.exe
2032	MSBuild.exe
2032	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	d21bc523c99c10eabde472f8315b1348.exe
Token: SeDebugPrivilege	2032	MSBuild.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 888	1956	d21bc523c99c10eabde472f8315b1348.exe	27
PID 1956 wrote to memory of 888	1956	d21bc523c99c10eabde472f8315b1348.exe	27
PID 1956 wrote to memory of 888	1956	d21bc523c99c10eabde472f8315b1348.exe	27
PID 888 wrote to memory of 1732	888	cmd.exe	29
PID 888 wrote to memory of 1732	888	cmd.exe	29
PID 888 wrote to memory of 1732	888	cmd.exe	29
PID 1956 wrote to memory of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32
PID 1956 wrote to memory of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32
PID 1956 wrote to memory of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32
PID 1956 wrote to memory of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32
PID 1956 wrote to memory of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32
PID 1956 wrote to memory of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32
PID 1956 wrote to memory of 2032	1956	d21bc523c99c10eabde472f8315b1348.exe	32
PID 2032 wrote to memory of 1812	2032	MSBuild.exe	34
PID 2032 wrote to memory of 1812	2032	MSBuild.exe	34
PID 2032 wrote to memory of 1812	2032	MSBuild.exe	34

C:\Users\Admin\AppData\Local\Temp\d21bc523c99c10eabde472f8315b1348.exe
"C:\Users\Admin\AppData\Local\Temp\d21bc523c99c10eabde472f8315b1348.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\system32\timeout.exe
    timeout 20
    3⤵
    - Delays execution with timeout.exe
    PID:1732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "Defau"
    3⤵
    PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-54-0x00000000012E0000-0x00000000012EA000-memory.dmp

Download

memory/1956-55-0x000000001B260000-0x000000001B262000-memory.dmp

Download

memory/1956-56-0x000000001EED0000-0x000000001F0AA000-memory.dmp

Download

memory/1956-57-0x000000001B266000-0x000000001B285000-memory.dmp

Download

memory/1956-60-0x000000001C480000-0x000000001C51E000-memory.dmp

Download

memory/2032-62-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/2032-64-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/2032-66-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/2032-70-0x000000001B310000-0x000000001B3B6000-memory.dmp

Download

memory/2032-71-0x0000000000860000-0x00000000008AE000-memory.dmp

Download

memory/2032-72-0x000000001B870000-0x000000001B872000-memory.dmp

Download

memory/2032-73-0x0000000000A40000-0x0000000000A8C000-memory.dmp

Download

memory/2032-74-0x000000001B876000-0x000000001B895000-memory.dmp

Download

memory/2032-75-0x000000001C250000-0x000000001C2A4000-memory.dmp

Download

memory/2032-61-0x0000000140000000-0x000000014007A000-memory.dmp

Download