Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 12:40
Behavioral task
behavioral1
Sample
9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe
-
Size
658KB
-
MD5
a5695f82fa2ac0bf31ea53da35f48ff7
-
SHA1
347edf2679ad426c1ff9bb68fb984b79c067e171
-
SHA256
9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a
-
SHA512
5ebe14d6b70f24b6fd383df22ce1472a0b11db3805203004146808c16ac765884f0d5d36747f7de5aaccf7be74fd0a69bd6a28feb50875af9800c50cf15a90f6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exedescription pid process Token: SeIncreaseQuotaPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeSecurityPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeTakeOwnershipPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeLoadDriverPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeSystemProfilePrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeSystemtimePrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeProfSingleProcessPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeIncBasePriorityPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeCreatePagefilePrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeBackupPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeRestorePrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeShutdownPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeDebugPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeSystemEnvironmentPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeChangeNotifyPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeRemoteShutdownPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeUndockPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeManageVolumePrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeImpersonatePrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: SeCreateGlobalPrivilege 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: 33 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: 34 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: 35 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe Token: 36 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exepid process 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exedescription pid process target process PID 2496 wrote to memory of 4236 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe iexplore.exe PID 2496 wrote to memory of 4236 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe iexplore.exe PID 2496 wrote to memory of 4236 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe iexplore.exe PID 2496 wrote to memory of 4028 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe explorer.exe PID 2496 wrote to memory of 4028 2496 9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe"C:\Users\Admin\AppData\Local\Temp\9bc517bad059d0d52ca121e3d612f2283ee06a36f08f125f28f5f840c5365e9a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4028-130-0x0000000000000000-mapping.dmp