Analysis
-
max time kernel
85s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
P.I. Ref P.I051216.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
P.I. Ref P.I051216.exe
Resource
win10v2004-20220414-en
General
-
Target
P.I. Ref P.I051216.exe
-
Size
507KB
-
MD5
e5181badd9a9331327095df2f2fb4255
-
SHA1
0c428ad1712ba41675170773e1216f9b681dee47
-
SHA256
75e41eb7b9f88a279e41be0944ebe10df52c768f5b4992597d693fe58d96f4f1
-
SHA512
d4970a70f0e055cd083bd47ccd1c8ee6d78ed02f32b1f427aca01262eb2211a8ab0b69b71a69f6339fc4c6227295c9c2dfabb0952bd816ff1e74d4c9fe6032e9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
P.I. Ref P.I051216.exepid process 1556 P.I. Ref P.I051216.exe 1556 P.I. Ref P.I051216.exe 1556 P.I. Ref P.I051216.exe 1556 P.I. Ref P.I051216.exe 1556 P.I. Ref P.I051216.exe 1556 P.I. Ref P.I051216.exe 1556 P.I. Ref P.I051216.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
P.I. Ref P.I051216.exedescription pid process Token: SeDebugPrivilege 1556 P.I. Ref P.I051216.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
P.I. Ref P.I051216.exedescription pid process target process PID 1556 wrote to memory of 1984 1556 P.I. Ref P.I051216.exe schtasks.exe PID 1556 wrote to memory of 1984 1556 P.I. Ref P.I051216.exe schtasks.exe PID 1556 wrote to memory of 1984 1556 P.I. Ref P.I051216.exe schtasks.exe PID 1556 wrote to memory of 1984 1556 P.I. Ref P.I051216.exe schtasks.exe PID 1556 wrote to memory of 1960 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1960 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1960 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1960 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1040 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1040 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1040 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1040 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1832 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1832 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1832 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1832 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 528 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 528 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 528 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 528 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1712 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1712 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1712 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe PID 1556 wrote to memory of 1712 1556 P.I. Ref P.I051216.exe P.I. Ref P.I051216.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\P.I. Ref P.I051216.exe"C:\Users\Admin\AppData\Local\Temp\P.I. Ref P.I051216.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZDPDyyzaJA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAEC7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\P.I. Ref P.I051216.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P.I. Ref P.I051216.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P.I. Ref P.I051216.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P.I. Ref P.I051216.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\P.I. Ref P.I051216.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAEC7.tmpFilesize
1KB
MD5849df190db38e26d7c4d134c2263ff84
SHA1c9ff31f764734994a69a763d247b080fb65f8f36
SHA256f087e09a95a6057439f614d80dbff708a7697fde23b1413f1bc3f1c26392e73e
SHA512c48493599895e5a9f50109be8e8824c8119d8ee5a226b6016b0cfa58f9e6006a04dc5c7c62466290b327b6f9e61a31998ddf3f6a591358e69b4b352ea8f2d762
-
memory/1556-54-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1556-55-0x0000000074AE0000-0x000000007508B000-memory.dmpFilesize
5.7MB
-
memory/1984-56-0x0000000000000000-mapping.dmp