Overview

overview

10

Static

static

RO11039484.exe

windows7_x64

7

RO11039484.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-07-2022 07:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RO11039484.exe

  • Size

    814KB

  • MD5

    0ad0c3b353974a1ca9fc7343bd53c89c

  • SHA1

    17432c1edf7183f5c6567502b2ae7b5e188fc3db

  • SHA256

    9e5791d56ab1616fd28086994b3b2acc5b6f4af9c1ebfd78966a56fcc2780635

  • SHA512

    f80ffe2eafc868ab80d143baf292063bb13f4b6ee0cee889624ef49edde42a5601ace81ee8f5e85d06dffc882521be592999270b694cd3fa5523aef5f32a843d

Score
7/10

Malware Config

Signatures

  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RO11039484.exe
    "C:\Users\Admin\AppData\Local\Temp\RO11039484.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wtBhXT.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1384
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wtBhXT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1B10.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1060
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:912
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
          PID:1332
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          2⤵
            PID:1180
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
              PID:1084
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              2⤵
                PID:1808

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp1B10.tmp
              Filesize

              1KB

              MD5

              a65425837d9bfbc955694ca5612f1467

              SHA1

              06572f640dea872bbadcea8df4c10134926edb7d

              SHA256

              ed0629f8ba0971f1cb299359429b946e638e2290ed2b9ec69fd33f603a23c467

              SHA512

              7eb12a9445636e1951ac13e0f40707a490214f469e16ede168c5847c112a97925ad1e3a6bc2d21701aaad690f25451fbe7c968864dd8860efb1d5a5d55b043c5

              Download Submit

            • memory/1060-61-0x0000000000000000-mapping.dmp

              Download

            • memory/1384-59-0x0000000000000000-mapping.dmp

              Download

            • memory/1384-64-0x000000006E610000-0x000000006EBBB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/1384-65-0x000000006E610000-0x000000006EBBB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2004-54-0x0000000001120000-0x00000000011F2000-memory.dmp

              Filesize

              840KB

              Download

            • memory/2004-55-0x0000000076191000-0x0000000076193000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2004-56-0x00000000003A0000-0x00000000003C0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2004-57-0x0000000000380000-0x000000000038E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2004-58-0x0000000004FC0000-0x0000000005052000-memory.dmp

              Filesize

              584KB

              Download

            • memory/2004-63-0x00000000050D0000-0x000000000511A000-memory.dmp

              Filesize

              296KB

              Download