5767c03c99b81a66dfc473594b0a85db93e8ad82aa35a6811b37d040487eb413

General

Target

v????_?? _PO_55956999.exe
Size

536KB
MD5

a43763b970a869ff32d39dd605f827a4
SHA1

17580d9a776422d289a79c8232768e0979aaf0ed
SHA256

986d7ca543c0f353e3ddc5bffd84904eea3c589ade8d3bb43ceda3d8e29704e2
SHA512

e9ac46ef5d41e541b5a991660987192467f04fd89e0933812c3245d401cd388a04ab55a6eca99f48f98e8c8599a407f13a77f769cf5f65ed78208734517f44f8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1572 schtasks.exe

pid	process
1572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

v_______ _PO_55956999.exe

pid	process
2036	v_______ _PO_55956999.exe
2036	v_______ _PO_55956999.exe
2036	v_______ _PO_55956999.exe
2036	v_______ _PO_55956999.exe
2036	v_______ _PO_55956999.exe
2036	v_______ _PO_55956999.exe
2036	v_______ _PO_55956999.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

v_______ _PO_55956999.exe

description pid process

Token: SeDebugPrivilege 2036 v_______ _PO_55956999.exe

description	pid	process
Token: SeDebugPrivilege	2036	v_______ _PO_55956999.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

v_______ _PO_55956999.exe

description	pid	process	target process
PID 2036 wrote to memory of 1572	2036	v_______ _PO_55956999.exe	schtasks.exe
PID 2036 wrote to memory of 1572	2036	v_______ _PO_55956999.exe	schtasks.exe
PID 2036 wrote to memory of 1572	2036	v_______ _PO_55956999.exe	schtasks.exe
PID 2036 wrote to memory of 1572	2036	v_______ _PO_55956999.exe	schtasks.exe
PID 2036 wrote to memory of 1452	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1452	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1452	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1452	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1508	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1508	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1508	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1508	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1596	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1596	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1596	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1596	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1608	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1608	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1608	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 1608	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 320	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 320	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 320	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe
PID 2036 wrote to memory of 320	2036	v_______ _PO_55956999.exe	v_______ _PO_55956999.exe

C:\Users\Admin\AppData\Local\Temp\v_______ _PO_55956999.exe
"C:\Users\Admin\AppData\Local\Temp\v_______ _PO_55956999.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jjvqcFhsrOdixV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7649.tmp"
2⤵
- Creates scheduled task(s)
PID:1572

C:\Users\Admin\AppData\Local\Temp\v_______ _PO_55956999.exe
"{path}"
2⤵
PID:1452

C:\Users\Admin\AppData\Local\Temp\v_______ _PO_55956999.exe
"{path}"
2⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\v_______ _PO_55956999.exe
"{path}"
2⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\v_______ _PO_55956999.exe
"{path}"
2⤵
PID:1608

C:\Users\Admin\AppData\Local\Temp\v_______ _PO_55956999.exe
"{path}"
2⤵
PID:320

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7649.tmp
Filesize
1KB

MD5
92b50cc7eb42c1c5e2619dc75b7ff19a

SHA1
904791145b9d3798b03c14ed6ed5275e2893e6a9

SHA256
c593348104dd3ef69dbf38a7d19056ee061e992d3b42eedb7ad11b7f2fdd9568

SHA512
8ec7ba787837c6f34273861bf162c2b494ddbb93dcaae8a5386ed1442394f24c4abde70d630f2f6f78740457e857bea9e0e2b588e1a0c6e3296fe8136cfde50a

Download Submit
memory/1572-56-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075C01000-0x0000000075C03000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads