Analysis
-
max time kernel
56s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
COSU 6270575380 PCL2004868048.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
COSU 6270575380 PCL2004868048.exe
Resource
win10v2004-20220414-en
General
-
Target
COSU 6270575380 PCL2004868048.exe
-
Size
606KB
-
MD5
d1d433ad7fe5db077cb81ef0e4ec4e60
-
SHA1
d94a577faa1557bef7fd9d2eecf7386ec3ea7e88
-
SHA256
b4b4e82b4584a55722d213ea607a3b1131caaa039589a27e12ba4feeeaee7fb5
-
SHA512
b1dbb723d3a342ef6666a9d11cca5182bc2228c146f2d6912eac3ea337bc1bb9b9ab55a11c1a95bf9a5bc834c41870d8b3fb2d5baafc99106289eb3c2a2b0c4c
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
COSU 6270575380 PCL2004868048.exepid process 1928 COSU 6270575380 PCL2004868048.exe 1928 COSU 6270575380 PCL2004868048.exe 1928 COSU 6270575380 PCL2004868048.exe 1928 COSU 6270575380 PCL2004868048.exe 1928 COSU 6270575380 PCL2004868048.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
COSU 6270575380 PCL2004868048.exedescription pid process Token: SeDebugPrivilege 1928 COSU 6270575380 PCL2004868048.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
COSU 6270575380 PCL2004868048.exedescription pid process target process PID 1928 wrote to memory of 1528 1928 COSU 6270575380 PCL2004868048.exe schtasks.exe PID 1928 wrote to memory of 1528 1928 COSU 6270575380 PCL2004868048.exe schtasks.exe PID 1928 wrote to memory of 1528 1928 COSU 6270575380 PCL2004868048.exe schtasks.exe PID 1928 wrote to memory of 1528 1928 COSU 6270575380 PCL2004868048.exe schtasks.exe PID 1928 wrote to memory of 1232 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 1232 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 1232 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 1232 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2024 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2024 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2024 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2024 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2016 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2016 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2016 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2016 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2044 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2044 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2044 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 2044 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 1720 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 1720 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 1720 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe PID 1928 wrote to memory of 1720 1928 COSU 6270575380 PCL2004868048.exe COSU 6270575380 PCL2004868048.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UGVpSjQyl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD338.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"C:\Users\Admin\AppData\Local\Temp\COSU 6270575380 PCL2004868048.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD338.tmpFilesize
1KB
MD500f08ad6772a07c289e09870ea2aae39
SHA1b7dbbad387be5c204ff09b0dea94ec55fea66a0e
SHA256fc8138459966d731bae0ea62f7c1a965612a94366c4138ca1cf6295a0bc46f3a
SHA5123b72321ea7aa12f1c7f7c3f145a8f84c239b0dd66fdbebf090481c379572dd1daf7587f99e28c05e2992690791745b671799f97b2f41a71c7248430ec87bf2b5
-
memory/1528-59-0x0000000000000000-mapping.dmp
-
memory/1928-54-0x0000000000240000-0x00000000002DE000-memory.dmpFilesize
632KB
-
memory/1928-55-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1928-56-0x0000000000220000-0x0000000000228000-memory.dmpFilesize
32KB
-
memory/1928-57-0x00000000051B0000-0x0000000005238000-memory.dmpFilesize
544KB
-
memory/1928-58-0x0000000004770000-0x00000000047CA000-memory.dmpFilesize
360KB