Analysis
-
max time kernel
74s -
max time network
95s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
18-05-2022 22:18
General
-
Target
e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd.exe
-
Size
809KB
-
MD5
ff72b295ded9889cee24320db368bcf1
-
SHA1
5d7991f8495d56088710dd558faba639ffd05292
-
SHA256
e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd
-
SHA512
37ab209741e90c78565d170ab48d7ee83c8633e93e646a4c8f639c305c8b6528841668b6aa7797870612d24e11e1ff1aaae0f5622e9a2195957f9142e93a7b1b
Malware Config
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd.exe"C:\Users\Admin\AppData\Local\Temp\e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn TxMT8hHkO8fBB5FlBurdwljpn /tr "C:\ProgramData\4vFAHkNczECIXuLdvBZKuXofw\IFMb39aGmCsqJcthXwNQEToq7.exe" /st 00:23 /du 23:59 /sc daily /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\4vFAHkNczECIXuLdvBZKuXofw\IFMb39aGmCsqJcthXwNQEToq7.exe"C:\ProgramData\4vFAHkNczECIXuLdvBZKuXofw\IFMb39aGmCsqJcthXwNQEToq7.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4212 -s 37203⤵
- Program crash
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7D05.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 63⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645.3MB
MD5cefe4318bdfb9eda69a4e1139e248b2c
SHA17be660c98730ed5275383a58cc02b9fb0ef4b6d9
SHA2561d8cd299086282708a0ec2f7cfffe064ddcd26da33b661e8e8227adbe2b3f8e6
SHA512aeb01ab0a19e8f6f0423a70736bea94f53219fd2a7a3b7764b00da06898099ca65b6ade289b378fb62496fe8a000ff32933d23c1324ad74f14e8767e941ecebc
-
Filesize
645.3MB
MD5cefe4318bdfb9eda69a4e1139e248b2c
SHA17be660c98730ed5275383a58cc02b9fb0ef4b6d9
SHA2561d8cd299086282708a0ec2f7cfffe064ddcd26da33b661e8e8227adbe2b3f8e6
SHA512aeb01ab0a19e8f6f0423a70736bea94f53219fd2a7a3b7764b00da06898099ca65b6ade289b378fb62496fe8a000ff32933d23c1324ad74f14e8767e941ecebc
-
Filesize
216B
MD5ee18249c2f31c935c6b2becc019954a7
SHA1901d12c4a69daae9042c702e0aae52bd37c4b41a
SHA25682f24a18fd0b6e1eadd78471b5ec2ca67fcfc829b413307c5770a3defbe3f832
SHA512b711e83a0abc3898903382a375c7aa65847c07f6f7561bb8631fd09278767ab4977abefd96db3f079e5d9a5df3c98ed1b47414b3e62546ad325391135b82f89a
-
Filesize
856KB
-
Filesize
24KB
-
Filesize
824KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
808KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
40KB
-
Filesize
12KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
64KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
12KB
-
Filesize
20KB
-
Filesize
24KB
-
Filesize
72KB
-
Filesize
16KB
-
Filesize
24KB