Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 08:53
Static task
static1
Behavioral task
behavioral1
Sample
FATURA HESABI.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
FATURA HESABI.exe
-
Size
25KB
-
MD5
9c6e67ca7790e12c09fa65bacf8b0618
-
SHA1
9b7f0452d2e9e6632457724f106d0b84ae8a8070
-
SHA256
35256002ef756a42079880ccdec95862e80830e69ebc56225f2b2a34ec28f771
-
SHA512
5db4e8ac7ad1df7c7142ac37a4774045db7324e01368dd7d9465a03561a5f825afbcf0341651ff615a110881ebb6b8ddb010b2ee1240b6baec3661aa22fcfde4
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1540 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeFATURA HESABI.exedescription pid process Token: SeDebugPrivilege 1540 powershell.exe Token: SeDebugPrivilege 2040 FATURA HESABI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
FATURA HESABI.exedescription pid process target process PID 2040 wrote to memory of 1540 2040 FATURA HESABI.exe powershell.exe PID 2040 wrote to memory of 1540 2040 FATURA HESABI.exe powershell.exe PID 2040 wrote to memory of 1540 2040 FATURA HESABI.exe powershell.exe PID 2040 wrote to memory of 1540 2040 FATURA HESABI.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FATURA HESABI.exe"C:\Users\Admin\AppData\Local\Temp\FATURA HESABI.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1540-56-0x0000000000000000-mapping.dmp
-
memory/1540-58-0x000000006FC90000-0x000000007023B000-memory.dmpFilesize
5.7MB
-
memory/1540-59-0x000000006FC90000-0x000000007023B000-memory.dmpFilesize
5.7MB
-
memory/2040-54-0x0000000000FF0000-0x0000000000FFC000-memory.dmpFilesize
48KB
-
memory/2040-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB