Analysis
-
max time kernel
96s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
05-08-2022 18:23
Static task
static1
Behavioral task
behavioral1
Sample
d4278af4c129db3ea1c48d890304abd1.exe
Resource
win7-20220718-en
General
-
Target
d4278af4c129db3ea1c48d890304abd1.exe
-
Size
616KB
-
MD5
d4278af4c129db3ea1c48d890304abd1
-
SHA1
b6ca93a2c12c164a73339020070662b618723744
-
SHA256
9d19de1d4be447775e3345eae357a9571bd86a607eaf25df48a6840acbc390cc
-
SHA512
807c9a5242a831f2f70e8a949a11c58cfe79b9438a7c2d5484ce899cef6f2f8574f7b03a8d896b5e6473669738266cb04b1b0f9c5e63d85c4c2a00e132b9dcc2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
d4278af4c129db3ea1c48d890304abd1.exepowershell.exepid process 892 d4278af4c129db3ea1c48d890304abd1.exe 892 d4278af4c129db3ea1c48d890304abd1.exe 892 d4278af4c129db3ea1c48d890304abd1.exe 892 d4278af4c129db3ea1c48d890304abd1.exe 892 d4278af4c129db3ea1c48d890304abd1.exe 1272 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d4278af4c129db3ea1c48d890304abd1.exepowershell.exedescription pid process Token: SeDebugPrivilege 892 d4278af4c129db3ea1c48d890304abd1.exe Token: SeDebugPrivilege 1272 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
d4278af4c129db3ea1c48d890304abd1.exedescription pid process target process PID 892 wrote to memory of 1272 892 d4278af4c129db3ea1c48d890304abd1.exe powershell.exe PID 892 wrote to memory of 1272 892 d4278af4c129db3ea1c48d890304abd1.exe powershell.exe PID 892 wrote to memory of 1272 892 d4278af4c129db3ea1c48d890304abd1.exe powershell.exe PID 892 wrote to memory of 1272 892 d4278af4c129db3ea1c48d890304abd1.exe powershell.exe PID 892 wrote to memory of 2040 892 d4278af4c129db3ea1c48d890304abd1.exe schtasks.exe PID 892 wrote to memory of 2040 892 d4278af4c129db3ea1c48d890304abd1.exe schtasks.exe PID 892 wrote to memory of 2040 892 d4278af4c129db3ea1c48d890304abd1.exe schtasks.exe PID 892 wrote to memory of 2040 892 d4278af4c129db3ea1c48d890304abd1.exe schtasks.exe PID 892 wrote to memory of 1716 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1716 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1716 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1716 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 2012 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 2012 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 2012 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 2012 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1380 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1380 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1380 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1380 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1060 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1060 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1060 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 1060 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 824 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 824 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 824 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe PID 892 wrote to memory of 824 892 d4278af4c129db3ea1c48d890304abd1.exe d4278af4c129db3ea1c48d890304abd1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZgolgcKGNozdg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZgolgcKGNozdg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3248.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"C:\Users\Admin\AppData\Local\Temp\d4278af4c129db3ea1c48d890304abd1.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3248.tmpFilesize
1KB
MD50f4dae0c9b5a66c5ac4cbe03094bfaed
SHA15841850c6a64f94f25ad28b915c4734acd427e8c
SHA256077f17f5043fb894057c30c28a51f5cc91e6fb374b1325b91efe0ccde3efee29
SHA5124ee6126b0c4960fe7023f0026bd04cb756a9579c85122987b5c7ee8f27a6692d98724c1117d788f735439ea90a018802ddb5c6b30c5f0fcb111dc6174b2b44c6
-
memory/892-54-0x00000000003D0000-0x0000000000470000-memory.dmpFilesize
640KB
-
memory/892-55-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/892-56-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/892-57-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/892-58-0x000000000A310000-0x000000000A372000-memory.dmpFilesize
392KB
-
memory/892-63-0x0000000004490000-0x00000000044A4000-memory.dmpFilesize
80KB
-
memory/1272-59-0x0000000000000000-mapping.dmp
-
memory/1272-64-0x000000006C730000-0x000000006CCDB000-memory.dmpFilesize
5.7MB
-
memory/2040-60-0x0000000000000000-mapping.dmp