Analysis
-
max time kernel
120s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-10-2022 17:51
Static task
static1
Behavioral task
behavioral1
Sample
cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe
Resource
win10v2004-20220901-en
General
-
Target
cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe
-
Size
1.0MB
-
MD5
4d978699b2bfe1caa498959e6f8d24c6
-
SHA1
5b3741f09c2a9a43deaa46ed96df18d01c7813c6
-
SHA256
cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83
-
SHA512
4a9fd3e03d0c1dae3edd3caaf11cd0d38bc2a15609ace7998bdd151d0ef80a70d7928418db4dfbd63af7e743fccb64df45bad6ec4f9017209d92e805d0f9e040
-
SSDEEP
24576:Nqymo1qR8bFCvTsBmx8NMMnGNHR3kQKSBm:Nq6QBwBmx8mCkJkmg
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1308 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe Token: SeDebugPrivilege 984 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1608 wrote to memory of 984 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 26 PID 1608 wrote to memory of 984 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 26 PID 1608 wrote to memory of 984 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 26 PID 1608 wrote to memory of 984 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 26 PID 1608 wrote to memory of 1308 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 28 PID 1608 wrote to memory of 1308 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 28 PID 1608 wrote to memory of 1308 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 28 PID 1608 wrote to memory of 1308 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 28 PID 1608 wrote to memory of 520 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 30 PID 1608 wrote to memory of 520 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 30 PID 1608 wrote to memory of 520 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 30 PID 1608 wrote to memory of 520 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 30 PID 1608 wrote to memory of 1800 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 31 PID 1608 wrote to memory of 1800 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 31 PID 1608 wrote to memory of 1800 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 31 PID 1608 wrote to memory of 1800 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 31 PID 1608 wrote to memory of 468 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 32 PID 1608 wrote to memory of 468 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 32 PID 1608 wrote to memory of 468 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 32 PID 1608 wrote to memory of 468 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 32 PID 1608 wrote to memory of 1884 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 33 PID 1608 wrote to memory of 1884 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 33 PID 1608 wrote to memory of 1884 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 33 PID 1608 wrote to memory of 1884 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 33 PID 1608 wrote to memory of 1756 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 34 PID 1608 wrote to memory of 1756 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 34 PID 1608 wrote to memory of 1756 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 34 PID 1608 wrote to memory of 1756 1608 cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RhEwdULrmpxS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RhEwdULrmpxS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp116F.tmp"2⤵
- Creates scheduled task(s)
PID:1308
-
-
C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"2⤵PID:520
-
-
C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"2⤵PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"2⤵PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"2⤵PID:1884
-
-
C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"C:\Users\Admin\AppData\Local\Temp\cacdd063765d8392c5170288190233117fd8c99fee8290613c0834f4e1f4fa83.exe"2⤵PID:1756
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5dc7be0b4a8ba9f17af04f79c6c654ac8
SHA1db28ce839d0341efbf12c5c6aa1d77765418b867
SHA2565ca50f5937d76d28d4e22f6d2fe321de617e71da48246a8ff104a4bf3c6d2ab3
SHA512a87539f91085ba32cda6a441bff047951b2d0b469c1cb59562b6fb4550461c86d15b5fd23aa75b61c2193fa968995dd8e8379269a58cf10fc9120d2873bdbd51