Analysis
-
max time kernel
97s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:51
Static task
static1
Behavioral task
behavioral1
Sample
PO 0856.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO 0856.exe
Resource
win10v2004-20220414-en
General
-
Target
PO 0856.exe
-
Size
826KB
-
MD5
d67f23392b5e1640bd691a86d77f3069
-
SHA1
4d5944a0a8ac2ae68caed78133958b8c4fdf1dbd
-
SHA256
54c429599d77052c7db47b68ac4c028065c4cabe7645ced48300a3ad774414ed
-
SHA512
b60d393e27f764ea7bcd43c43f67f58a9db326820382f6dc2b19660f09471bac0a9844b85030693af02101afd9ddca608dedcfff03c8ad99c4c25aa6a012c429
Malware Config
Signatures
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/908-56-0x0000000006780000-0x0000000006830000-memory.dmp rezer0 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO 0856.exepid process 908 PO 0856.exe 908 PO 0856.exe 908 PO 0856.exe 908 PO 0856.exe 908 PO 0856.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO 0856.exedescription pid process Token: SeDebugPrivilege 908 PO 0856.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
PO 0856.exedescription pid process target process PID 908 wrote to memory of 320 908 PO 0856.exe schtasks.exe PID 908 wrote to memory of 320 908 PO 0856.exe schtasks.exe PID 908 wrote to memory of 320 908 PO 0856.exe schtasks.exe PID 908 wrote to memory of 320 908 PO 0856.exe schtasks.exe PID 908 wrote to memory of 956 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 956 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 956 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 956 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1908 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1908 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1908 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1908 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 560 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 560 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 560 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 560 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1872 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1872 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1872 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 1872 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 880 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 880 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 880 908 PO 0856.exe PO 0856.exe PID 908 wrote to memory of 880 908 PO 0856.exe PO 0856.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 0856.exe"C:\Users\Admin\AppData\Local\Temp\PO 0856.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\swGthhEL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4970.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO 0856.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO 0856.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO 0856.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO 0856.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO 0856.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4970.tmpFilesize
1KB
MD571656eacd4e12e01ea4918af799dc1f8
SHA15d9e4e574f2286404702a4570b8ec37a478bb579
SHA2564805168eb6b0ae26c05cb05e52eca4890436c8dd9dc69f04ff80abeb39991db4
SHA512123bf3e07f5635d2fe00b804364b13c6b304aceff6241e1acd56681a53e2a5ef8c636f745019e3a116aebf0d850f00e6fa6e8e0541dbe1b7d8cfcbf604964e40
-
memory/320-57-0x0000000000000000-mapping.dmp
-
memory/908-54-0x00000000003E0000-0x00000000004B4000-memory.dmpFilesize
848KB
-
memory/908-55-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/908-56-0x0000000006780000-0x0000000006830000-memory.dmpFilesize
704KB