Overview

overview

10

Static

static

News-Update.scr

windows7_x64

3

News-Update.scr

windows10-2004_x64

10

Analysis

  • max time kernel
    44s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 11:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    News-Update.scr

  • Size

    566KB

  • MD5

    8db27a63baec87e325fe3245f6778790

  • SHA1

    c639dd9daf6f010142a37ef1fac0fbd8a00c3efd

  • SHA256

    8c254637c5c98fe6755a44e5ea6feba18d0a17c4ad53e8d791277390060c29e5

  • SHA512

    423c2b2d5400079f21025c5c2f0242aba1aeaa3fd9844b06678246e20fc65ae027dbad161ddbb2be10ca61fa992903b21e0d29cd3c415145b760e047377c1201

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\News-Update.scr
    "C:\Users\Admin\AppData\Local\Temp\News-Update.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YThapGcLkG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA47A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2032
    • C:\Users\Admin\AppData\Local\Temp\News-Update.scr
      "{path}"
      2⤵
        PID:1984
      • C:\Users\Admin\AppData\Local\Temp\News-Update.scr
        "{path}"
        2⤵
          PID:944
        • C:\Users\Admin\AppData\Local\Temp\News-Update.scr
          "{path}"
          2⤵
            PID:1452
          • C:\Users\Admin\AppData\Local\Temp\News-Update.scr
            "{path}"
            2⤵
              PID:940
            • C:\Users\Admin\AppData\Local\Temp\News-Update.scr
              "{path}"
              2⤵
                PID:1204

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Credential Access

            Discovery

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpA47A.tmp
              Filesize

              1KB

              MD5

              c7c060a60006143ad7d7496e3927f020

              SHA1

              262223194d0dace8597e5a6e56d0630c26a5bc79

              SHA256

              c2f4af14afa93f77781b7955cf6f8a4f155beaaacad54726519c9e54a9c9fb29

              SHA512

              5f18c311ad4965e5bbdade67a30d8839441938e1c0748dbd706cf2877b29577f3a9e031ab88c88f14c34a07b11ab0c6cea3444c22ad5db6521b0d308cbca6287

              Download Submit
            • memory/1504-54-0x00000000003C0000-0x0000000000454000-memory.dmp
              Filesize

              592KB

              Download
            • memory/1504-55-0x0000000000540000-0x000000000054A000-memory.dmp
              Filesize

              40KB

              Download
            • memory/1504-56-0x0000000002070000-0x00000000020C4000-memory.dmp
              Filesize

              336KB

              Download
            • memory/1504-57-0x0000000076561000-0x0000000076563000-memory.dmp
              Filesize

              8KB

              Download
            • memory/2032-58-0x0000000000000000-mapping.dmp
              Download