b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3

General

Target

b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
Size

1.1MB
MD5

27894c3876db96d4beb862daaae52e07
SHA1

6baa94cb18f135f03b7ae3fcbb80c600d44fdfd0
SHA256

b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3
SHA512

7caadfcbddabb5629dc765d4c94ab91866d01a10b8081c51de8a12e053a6eea9c71bd7b86ea74de5804c88993d64cf2537efc46e6650cf9c4a98502218fb616f
SSDEEP

24576:3L4LJNZ2RWEmmd9JKgmus+BUSB15OwP4:ELJNemmi+rK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

956 schtasks.exe

pid	process
956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exepowershell.exe

pid	process
1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe

C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
"C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bmzmLDNY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bmzmLDNY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B18.tmp"
2⤵
- Creates scheduled task(s)
PID:956

C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
"C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe"
2⤵
PID:904

C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
"C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe"
2⤵
PID:892

C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
"C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe"
2⤵
PID:1124

C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
"C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe"
2⤵
PID:1820

C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
"C:\Users\Admin\AppData\Local\Temp\b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe"
2⤵
PID:268

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9B18.tmp
Filesize
1KB

MD5
0d8240ee12fd2f04a4f51c75369f4831

SHA1
cfeb2ac390202bf9c80975adbfe7f88ec312343b

SHA256
af38297312e8a8d0ccb2a620a7a21c55be70c55218460e200183bbab5f25f221

SHA512
29558e5b2994ab2afdcf69310dd08b418b2c640618f8e3a2d5078dc65c611b561a341846222f43c315c331852a2c217c73281a26a64a1c3c99a99201571fef6c

Download Submit
memory/956-60-0x0000000000000000-mapping.dmp

Download
memory/1348-54-0x0000000000370000-0x0000000000486000-memory.dmp

Filesize
1.1MB

Download
memory/1348-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1348-56-0x0000000000780000-0x000000000079A000-memory.dmp

Filesize
104KB

Download
memory/1348-57-0x0000000002010000-0x000000000201C000-memory.dmp

Filesize
48KB

Download
memory/1348-58-0x0000000004D50000-0x0000000004DD8000-memory.dmp

Filesize
544KB

Download
memory/1348-63-0x0000000005050000-0x000000000507E000-memory.dmp

Filesize
184KB

Download
memory/1944-59-0x0000000000000000-mapping.dmp

Download
memory/1944-64-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-65-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-66-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 1348 wrote to memory of 1944	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	powershell.exe
PID 1348 wrote to memory of 1944	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	powershell.exe
PID 1348 wrote to memory of 1944	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	powershell.exe
PID 1348 wrote to memory of 1944	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	powershell.exe
PID 1348 wrote to memory of 956	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	schtasks.exe
PID 1348 wrote to memory of 956	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	schtasks.exe
PID 1348 wrote to memory of 956	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	schtasks.exe
PID 1348 wrote to memory of 956	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	schtasks.exe
PID 1348 wrote to memory of 904	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 904	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 904	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 904	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 892	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 892	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 892	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 892	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1124	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1124	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1124	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1124	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1820	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1820	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1820	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 1820	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 268	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 268	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 268	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe
PID 1348 wrote to memory of 268	1348	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe	b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads