Analysis
-
max time kernel
53s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
08-08-2022 12:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220721-en
General
-
Target
tmp.exe
-
Size
2.4MB
-
MD5
05f6fa39a293a904e53aad577744ee8e
-
SHA1
99126bc0831b9d49eb46fd6dcdf7a12376db415d
-
SHA256
928f75ac182baea6734e08cdd425bcea33bf7f27a43922b9f693d199d7aee550
-
SHA512
3136c7a911b07496d0f85885780edf684592ec265173801a1a472406a8b73bc1bebe0fa48202ded9b83acb8a0f633d6b1ce1657adc6a5775ca8946010d76df9b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
tmp.exepowershell.exepid process 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 1876 tmp.exe 828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exepowershell.exedescription pid process Token: SeDebugPrivilege 1876 tmp.exe Token: SeDebugPrivilege 828 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
tmp.exepid process 1876 tmp.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
tmp.exepid process 1876 tmp.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
tmp.exedescription pid process target process PID 1876 wrote to memory of 828 1876 tmp.exe powershell.exe PID 1876 wrote to memory of 828 1876 tmp.exe powershell.exe PID 1876 wrote to memory of 828 1876 tmp.exe powershell.exe PID 1876 wrote to memory of 828 1876 tmp.exe powershell.exe PID 1876 wrote to memory of 1740 1876 tmp.exe schtasks.exe PID 1876 wrote to memory of 1740 1876 tmp.exe schtasks.exe PID 1876 wrote to memory of 1740 1876 tmp.exe schtasks.exe PID 1876 wrote to memory of 1740 1876 tmp.exe schtasks.exe PID 1876 wrote to memory of 520 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 520 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 520 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 520 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 764 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 764 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 764 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 764 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1392 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1392 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1392 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1392 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1908 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1908 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1908 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 1908 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 2012 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 2012 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 2012 1876 tmp.exe tmp.exe PID 1876 wrote to memory of 2012 1876 tmp.exe tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HziGohhJaJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HziGohhJaJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB51D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB51D.tmpFilesize
1KB
MD548f4c32e58d356ecede893e6a3a4c515
SHA10d9879c4ee18cd9455732b0a8e5346b927dd8acb
SHA2560e28452eda502854a0c81f57ce28d4e91ae17805ade8d9abc638c1723e34b2d3
SHA5126cf36ba88e9a5bc816d71568881364b805b5f9e3e5c68d047bc75a15cf03cd03fcc42bbe8f24310d890832898e76643c39204ae4712a38db2e6298a13f556a40
-
memory/828-59-0x0000000000000000-mapping.dmp
-
memory/828-64-0x000000006E160000-0x000000006E70B000-memory.dmpFilesize
5.7MB
-
memory/828-65-0x000000006E160000-0x000000006E70B000-memory.dmpFilesize
5.7MB
-
memory/1740-60-0x0000000000000000-mapping.dmp
-
memory/1876-54-0x00000000001D0000-0x0000000000440000-memory.dmpFilesize
2.4MB
-
memory/1876-55-0x0000000075DC1000-0x0000000075DC3000-memory.dmpFilesize
8KB
-
memory/1876-56-0x0000000000800000-0x0000000000820000-memory.dmpFilesize
128KB
-
memory/1876-57-0x00000000020B0000-0x00000000020BC000-memory.dmpFilesize
48KB
-
memory/1876-58-0x000000000A990000-0x000000000AAFE000-memory.dmpFilesize
1.4MB
-
memory/1876-63-0x000000000A6B0000-0x000000000A7E8000-memory.dmpFilesize
1.2MB