896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b

General

Target

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
Size

26KB
MD5

05b52fcc52f9ed9a6075ca818061b520
SHA1

e6da7ea0e2d2bf1a6d204a46c2422620aca07e26
SHA256

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b
SHA512

8fdbca0f8bb7d128f96506f5474487960ff0e8c7f4662f9be3c275159efc44f3be833e391ba78b08af9579c0e6bad5ec98d25fa8ec73a64ae682c587bc670fb7
SSDEEP

768:fhLH26CG8gTC9F0w6dGPDISFPDlzr7E3ByKxKzJRl+JTc:VRFvTCEwmSNDO7tJY

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1080 cmd.exe

pid	process
1080	cmd.exe

Drops file in System32 directory 5 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sxload.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File created	C:\Windows\System32\123A66F.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File opened for modification	C:\Windows\SysWOW64\123A66F.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File created	C:\Windows\System32\123E9F4.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File opened for modification	C:\Windows\SysWOW64\123E9F4.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

Drops file in Program Files directory 1 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

description ioc process

File created C:\Program Files (x86)\Common Files\sxmy.tmp 896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2004 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

pid process

848 896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\sxmy.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

pid	process
2004	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
Token: SeDebugPrivilege	2004	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

pid	process
848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

description	pid	process	target process
PID 848 wrote to memory of 2004	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	taskkill.exe
PID 848 wrote to memory of 2004	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	taskkill.exe
PID 848 wrote to memory of 2004	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	taskkill.exe
PID 848 wrote to memory of 2004	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	taskkill.exe
PID 848 wrote to memory of 1080	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 848 wrote to memory of 1080	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 848 wrote to memory of 1080	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 848 wrote to memory of 1080	848	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
"C:\Users\Admin\AppData\Local\Temp\896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "soul.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c 1.bat
2⤵
- Deletes itself
PID:1080

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat
Filesize
251B

MD5
7c12d268e4b947de02f85d7bc526e4f2

SHA1
3abed93ebf6c3226aacb351f9135f0b25c2d78ff

SHA256
d87728727e28d48c96ea2aaf2e77bf32e496120212e6e2eb60455e8a9678940d

SHA512
5a3d261e342aaffb960db01cf72abd46907295952607c5ff5bf3891f72205af40a994060557df267f5726e7ef7d6ebc7e99036bacd6d4be591a5723d61d50c29

Download Submit
memory/848-54-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/848-55-0x00000000747D1000-0x00000000747D3000-memory.dmp

Filesize
8KB

Download
memory/1080-57-0x0000000000000000-mapping.dmp

Download
memory/2004-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads