Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 13:34
Static task
static1
Behavioral task
behavioral1
Sample
Komercijalna.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Komercijalna.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Komercijalna.exe
-
Size
75KB
-
MD5
a345151fb544be3e1df9f07be51063e1
-
SHA1
0d0e194f720298af42a04628290704eb53bf6e96
-
SHA256
d37759d28521bfeb8b4f5de10692edb29c3bbf6a377e8f16aa9309cf5a978571
-
SHA512
0a32c56b637df341761599a27b167e562a5d288136bb964b9298b1dbf3a7147fec59b1509820d96603d6b232a1a442ef6639961e32825cf2ed7d71f0b25792b3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1508 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeKomercijalna.exedescription pid process Token: SeDebugPrivilege 1508 powershell.exe Token: SeDebugPrivilege 1992 Komercijalna.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Komercijalna.exedescription pid process target process PID 1992 wrote to memory of 1508 1992 Komercijalna.exe powershell.exe PID 1992 wrote to memory of 1508 1992 Komercijalna.exe powershell.exe PID 1992 wrote to memory of 1508 1992 Komercijalna.exe powershell.exe PID 1992 wrote to memory of 1508 1992 Komercijalna.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Komercijalna.exe"C:\Users\Admin\AppData\Local\Temp\Komercijalna.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-56-0x0000000000000000-mapping.dmp
-
memory/1508-58-0x000000006F6B0000-0x000000006FC5B000-memory.dmpFilesize
5.7MB
-
memory/1508-59-0x000000006F6B0000-0x000000006FC5B000-memory.dmpFilesize
5.7MB
-
memory/1992-54-0x00000000003C0000-0x00000000003D8000-memory.dmpFilesize
96KB
-
memory/1992-55-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB