Analysis
- max time kernel
42s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
08/11/2022, 12:34
General
- Target file.exe
- Size 2.3MB
- Sample221108-prryzsgbe4
- SHA256 b94715b349fa92ac26575bb78b6aa84d73dbf69cdc0c0ee5c250fc64bb741c47
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp71C7.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\WindowsMail\AVPTQBAEW.exe"C:\ProgramData\WindowsMail\AVPTQBAEW.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 780 -s 10964⤵
- Loads dropped DLL
- Program crash
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
AVPTQBAEW.exe
AVPTQBAEW.exe
tmp71C7.tmp.bat
590aee7bdd69b59b.customDestinations-ms
AVPTQBAEW.exe
AVPTQBAEW.exe
AVPTQBAEW.exe
AVPTQBAEW.exe
AVPTQBAEW.exe
AVPTQBAEW.exe
memory/560-128-0x000000000259B000-0x00000000025BA000-memory.dmp
memory/560-127-0x0000000002594000-0x0000000002597000-memory.dmp
memory/560-126-0x000000001B790000-0x000000001BA8F000-memory.dmp
memory/560-123-0x0000000002594000-0x0000000002597000-memory.dmp
memory/560-121-0x000007FEECD10000-0x000007FEED86D000-memory.dmp
memory/560-119-0x000007FEED870000-0x000007FEEE293000-memory.dmp
memory/780-99-0x000007FEFDEF0000-0x000007FEFDF8F000-memory.dmp
memory/780-106-0x0000000000570000-0x00000000005B2000-memory.dmp
memory/780-138-0x0000000001100000-0x0000000001334000-memory.dmp
memory/780-137-0x0000000000570000-0x00000000005B2000-memory.dmp
memory/780-131-0x000007FEF6C50000-0x000007FEF6D88000-memory.dmp
memory/780-130-0x000007FEFE000000-0x000007FEFE01F000-memory.dmp
memory/780-129-0x000007FEFE870000-0x000007FEFE947000-memory.dmp
memory/780-124-0x000007FEFBE90000-0x000007FEFC0A5000-memory.dmp
memory/780-104-0x000007FEFF760000-0x000007FEFF83B000-memory.dmp
memory/780-115-0x000007FEFD050000-0x000007FEFD067000-memory.dmp
memory/780-114-0x000007FEFD1A0000-0x000007FEFD1C2000-memory.dmp
memory/780-108-0x000007FEFE400000-0x000007FEFE603000-memory.dmp
memory/780-110-0x000007FEFC0B0000-0x000007FEFC106000-memory.dmp
memory/780-112-0x0000000001100000-0x0000000001334000-memory.dmp
memory/780-113-0x000007FEF6D90000-0x000007FEF6EBC000-memory.dmp
memory/780-111-0x0000000001100000-0x0000000001334000-memory.dmp
memory/780-109-0x0000000001100000-0x0000000001334000-memory.dmp
memory/780-107-0x000007FEFFBF0000-0x000007FEFFD1D000-memory.dmp
memory/780-95-0x000007FEFB7C0000-0x000007FEFB82F000-memory.dmp
memory/780-96-0x000007FEFB720000-0x000007FEFB7BC000-memory.dmp
memory/780-97-0x000007FEFDF90000-0x000007FEFDFF7000-memory.dmp
memory/780-105-0x000007FEF5780000-0x000007FEF616C000-memory.dmp
memory/780-98-0x0000000077910000-0x0000000077A0A000-memory.dmp
memory/780-100-0x00000000777F0000-0x000000007790F000-memory.dmp
memory/780-102-0x000007FEFDBF0000-0x000007FEFDC61000-memory.dmp
memory/780-101-0x000007FEFD8E0000-0x000007FEFD94C000-memory.dmp
memory/780-103-0x000007FEFB5B0000-0x000007FEFB6A7000-memory.dmp
memory/1464-84-0x000007FEF6130000-0x000007FEF6B53000-memory.dmp
memory/1464-77-0x000007FEFC431000-0x000007FEFC433000-memory.dmp
memory/1464-88-0x00000000025AB000-0x00000000025CA000-memory.dmp
memory/1464-87-0x00000000025A4000-0x00000000025A7000-memory.dmp
memory/1464-86-0x00000000025A4000-0x00000000025A7000-memory.dmp
memory/1464-85-0x000007FEF55D0000-0x000007FEF612D000-memory.dmp
memory/1488-75-0x000007FEFD050000-0x000007FEFD067000-memory.dmp
memory/1488-63-0x00000000777F0000-0x000000007790F000-memory.dmp
memory/1488-69-0x000007FEFFBF0000-0x000007FEFFD1D000-memory.dmp
memory/1488-68-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp
memory/1488-67-0x000007FEFF760000-0x000007FEFF83B000-memory.dmp
memory/1488-72-0x0000000000860000-0x0000000000A94000-memory.dmp
memory/1488-66-0x000007FEFB510000-0x000007FEFB607000-memory.dmp
memory/1488-65-0x000007FEFDBF0000-0x000007FEFDC61000-memory.dmp
memory/1488-56-0x000007FEFB750000-0x000007FEFB7BF000-memory.dmp
memory/1488-82-0x0000000000140000-0x0000000000182000-memory.dmp
memory/1488-64-0x000007FEFD8E0000-0x000007FEFD94C000-memory.dmp
memory/1488-81-0x0000000000860000-0x0000000000A94000-memory.dmp
memory/1488-62-0x000007FEFDEF0000-0x000007FEFDF8F000-memory.dmp
memory/1488-73-0x000007FEF7070000-0x000007FEF719C000-memory.dmp
memory/1488-79-0x000007FEFE000000-0x000007FEFE01F000-memory.dmp
memory/1488-74-0x000007FEFD1A0000-0x000007FEFD1C2000-memory.dmp
memory/1488-58-0x0000000000860000-0x0000000000A94000-memory.dmp
memory/1488-61-0x0000000077910000-0x0000000077A0A000-memory.dmp
memory/1488-60-0x000007FEFDF90000-0x000007FEFDFF7000-memory.dmp
memory/1488-57-0x000007FEFB610000-0x000007FEFB6AC000-memory.dmp
memory/1488-59-0x0000000000140000-0x0000000000182000-memory.dmp
memory/1488-71-0x000007FEFC0B0000-0x000007FEFC106000-memory.dmp
memory/1488-70-0x000007FEFE400000-0x000007FEFE603000-memory.dmp