15e2f966937440c34a383f8a2df6fa8b380fbc858b7560e3129f563296e17fbb

General

Target
26ed0fe0f7c70df9e9f1f37d26f79c5b.exe
Size 133KB
Sample220608-gprlfacdfm
SHA256 15e2f966937440c34a383f8a2df6fa8b380fbc858b7560e3129f563296e17fbb
MD5 26ed0fe0f7c70df9e9f1f37d26f79c5b
SHA1 fc8df7cb950034963d9f658d481c9ffb88bc9c75
SHA512 8e1dec953e03bbfc3da957bd21081e004724be18e8e8f7b9cbc954970e8781015e35e2f31de375f6e96be89547531f2192b5c0a8740afd357c4d14704fb089fc
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1148	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe
892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe
432	InstallUtil.exe
432	InstallUtil.exe
432	InstallUtil.exe
432	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe
Token: SeDebugPrivilege	432	InstallUtil.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2036	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	28
PID 892 wrote to memory of 2036	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	28
PID 892 wrote to memory of 2036	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	28
PID 2036 wrote to memory of 1148	2036	cmd.exe	30
PID 2036 wrote to memory of 1148	2036	cmd.exe	30
PID 2036 wrote to memory of 1148	2036	cmd.exe	30
PID 892 wrote to memory of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31
PID 892 wrote to memory of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31
PID 892 wrote to memory of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31
PID 892 wrote to memory of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31
PID 892 wrote to memory of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31
PID 892 wrote to memory of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31
PID 892 wrote to memory of 432	892	26ed0fe0f7c70df9e9f1f37d26f79c5b.exe	31

C:\Users\Admin\AppData\Local\Temp\26ed0fe0f7c70df9e9f1f37d26f79c5b.exe
"C:\Users\Admin\AppData\Local\Temp\26ed0fe0f7c70df9e9f1f37d26f79c5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\timeout.exe
    timeout 20
    3⤵
    - Delays execution with timeout.exe
    PID:1148
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-62-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/432-72-0x000000001BB96000-0x000000001BBB5000-memory.dmp

Download

memory/432-71-0x000000001BB96000-0x000000001BBB5000-memory.dmp

Download

memory/432-70-0x00000000008C0000-0x000000000090E000-memory.dmp

Download

memory/432-59-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/432-69-0x000000001AC80000-0x000000001AD28000-memory.dmp

Download

memory/432-64-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/432-60-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/892-68-0x000000001B156000-0x000000001B175000-memory.dmp

Download

memory/892-54-0x000000013F340000-0x000000013F364000-memory.dmp

Download

memory/892-55-0x000000001C090000-0x000000001C1A6000-memory.dmp

Download

memory/892-56-0x00000000005A0000-0x00000000005EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads