Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
15/10/2022, 06:24
General
- Target 24fe1a3662a0e663a0f75066c3e0c98f.exe
- Size 10KB
- Sample221015-g52rcafcd7
- SHA256 a52ad50c2487aee8da9e4e9bc51dfedd293bd4c7fbf966297f6da63b11abacf2
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exe"C:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exeC:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {AFBB3025-AD99-42A9-A4AE-F4F0E1CE2B16} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exeC:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exeC:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
24fe1a3662a0e663a0f75066c3e0c98f.exe
24fe1a3662a0e663a0f75066c3e0c98f.exe
24fe1a3662a0e663a0f75066c3e0c98f.exe
590aee7bdd69b59b.customDestinations-ms
24fe1a3662a0e663a0f75066c3e0c98f.exe
memory/840-103-0x000000001BCB6000-0x000000001BCD5000-memory.dmp
memory/840-85-0x000000013F730000-0x000000013F736000-memory.dmp
memory/884-94-0x00000000029BB000-0x00000000029DA000-memory.dmp
memory/884-89-0x000007FEEC570000-0x000007FEECF93000-memory.dmp
memory/884-90-0x000007FEEBA10000-0x000007FEEC56D000-memory.dmp
memory/884-91-0x00000000029B4000-0x00000000029B7000-memory.dmp
memory/884-92-0x00000000029BB000-0x00000000029DA000-memory.dmp
memory/884-93-0x00000000029B4000-0x00000000029B7000-memory.dmp
memory/904-63-0x000000000252B000-0x000000000254A000-memory.dmp
memory/904-65-0x000000000252B000-0x000000000254A000-memory.dmp
memory/904-58-0x000007FEFC011000-0x000007FEFC013000-memory.dmp
memory/904-59-0x000007FEECB40000-0x000007FEED563000-memory.dmp
memory/904-61-0x0000000002524000-0x0000000002527000-memory.dmp
memory/904-60-0x000007FEEBFE0000-0x000007FEECB3D000-memory.dmp
memory/904-62-0x000000001B7A0000-0x000000001BA9F000-memory.dmp
memory/904-64-0x0000000002524000-0x0000000002527000-memory.dmp
memory/1600-79-0x00000000021D0000-0x0000000002224000-memory.dmp
memory/1600-76-0x000000001B960000-0x000000001BA0A000-memory.dmp
memory/1600-67-0x0000000140000000-0x000000014007A000-memory.dmp
memory/1600-69-0x0000000140000000-0x000000014007A000-memory.dmp
memory/1600-66-0x0000000140000000-0x000000014007A000-memory.dmp
memory/1600-71-0x0000000140000000-0x000000014007A000-memory.dmp
memory/1600-80-0x000000001BA66000-0x000000001BA85000-memory.dmp
memory/1600-78-0x0000000002180000-0x00000000021CC000-memory.dmp
memory/1600-77-0x00000000009E0000-0x0000000000A2E000-memory.dmp
memory/1720-54-0x000000013F920000-0x000000013F926000-memory.dmp
memory/1720-74-0x000000001BB26000-0x000000001BB45000-memory.dmp
memory/1720-56-0x000000001BD60000-0x000000001BDF2000-memory.dmp
memory/1720-55-0x000000001BEE0000-0x000000001C020000-memory.dmp