Analysis
- max time kernel
73s - max time network
64s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
12/11/2022, 04:12
General
- Target file.exe
- Size 1.2MB
- Sample221112-eshrlagg2z
- SHA256 fba6bdb44712ea2035fe42cb16a2c717c99047cde6d779ce82c013633305bdae
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp32C5.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\WindowsMail\AVPTQBAEW.exe"C:\ProgramData\WindowsMail\AVPTQBAEW.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"5⤵
- Creates scheduled task(s)
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
AVPTQBAEW.exe
AVPTQBAEW.exe
tmp32C5.tmp.bat
590aee7bdd69b59b.customDestinations-ms
AVPTQBAEW.exe
memory/1316-105-0x000007FEFD700000-0x000007FEFD903000-memory.dmp
memory/1316-124-0x000007FEFEBA0000-0x000007FEFEBBF000-memory.dmp
memory/1316-123-0x000007FEFF540000-0x000007FEFF617000-memory.dmp
memory/1316-125-0x000007FEFCB40000-0x000007FEFCB62000-memory.dmp
memory/1316-126-0x000007FEFC9F0000-0x000007FEFCA07000-memory.dmp
memory/1316-115-0x000007FEFB7F0000-0x000007FEFBA05000-memory.dmp
memory/1316-127-0x000007FEF1070000-0x000007FEF108C000-memory.dmp
memory/1316-128-0x000007FEF1090000-0x000007FEF10F2000-memory.dmp
memory/1316-129-0x000007FEFDA40000-0x000007FEFDA8D000-memory.dmp
memory/1316-138-0x0000000000170000-0x000000000036A000-memory.dmp
memory/1316-137-0x0000000000170000-0x000000000036A000-memory.dmp
memory/1316-130-0x000007FEF80E0000-0x000007FEF8144000-memory.dmp
memory/1316-110-0x000007FEF6710000-0x000007FEF683C000-memory.dmp
memory/1316-107-0x000007FEFBA40000-0x000007FEFBA96000-memory.dmp
memory/1316-108-0x0000000000170000-0x000000000036A000-memory.dmp
memory/1316-109-0x0000000000170000-0x000000000036A000-memory.dmp
memory/1316-136-0x0000000000120000-0x0000000000163000-memory.dmp
memory/1316-135-0x000007FEFC810000-0x000007FEFC86B000-memory.dmp
memory/1316-134-0x000007FEFD400000-0x000007FEFD436000-memory.dmp
memory/1316-133-0x000007FEFAAC0000-0x000007FEFAAE7000-memory.dmp
memory/1316-132-0x000007FEFCFC0000-0x000007FEFCFE5000-memory.dmp
memory/1316-131-0x000007FEF8150000-0x000007FEF81C1000-memory.dmp
memory/1316-106-0x0000000000170000-0x000000000036A000-memory.dmp
memory/1316-103-0x0000000000120000-0x0000000000163000-memory.dmp
memory/1316-104-0x000007FEFD910000-0x000007FEFDA3D000-memory.dmp
memory/1316-92-0x000007FEFB0F0000-0x000007FEFB15F000-memory.dmp
memory/1316-93-0x000007FEFAF10000-0x000007FEFAFAC000-memory.dmp
memory/1316-94-0x000007FEFD590000-0x000007FEFD5F7000-memory.dmp
memory/1316-95-0x00000000772B0000-0x00000000773AA000-memory.dmp
memory/1316-98-0x000007FEFD460000-0x000007FEFD4CC000-memory.dmp
memory/1316-97-0x0000000077190000-0x00000000772AF000-memory.dmp
memory/1316-96-0x000007FEFEB00000-0x000007FEFEB9F000-memory.dmp
memory/1316-99-0x000007FEFF0C0000-0x000007FEFF131000-memory.dmp
memory/1316-100-0x000007FEFAE10000-0x000007FEFAF07000-memory.dmp
memory/1316-101-0x000007FEFE820000-0x000007FEFE8FB000-memory.dmp
memory/1316-102-0x000007FEF5120000-0x000007FEF5B0C000-memory.dmp
memory/1328-56-0x000007FEFB160000-0x000007FEFB1CF000-memory.dmp
memory/1328-58-0x000007FEFD590000-0x000007FEFD5F7000-memory.dmp
memory/1328-62-0x000007FEFD460000-0x000007FEFD4CC000-memory.dmp
memory/1328-59-0x00000000772B0000-0x00000000773AA000-memory.dmp
memory/1328-79-0x0000000000E90000-0x000000000108A000-memory.dmp
memory/1328-63-0x000007FEFF0C0000-0x000007FEFF131000-memory.dmp
memory/1328-77-0x000007FEFEBA0000-0x000007FEFEBBF000-memory.dmp
memory/1328-64-0x000007FEFAEB0000-0x000007FEFAFA7000-memory.dmp
memory/1328-61-0x0000000077190000-0x00000000772AF000-memory.dmp
memory/1328-60-0x000007FEFEB00000-0x000007FEFEB9F000-memory.dmp
memory/1328-65-0x000007FEFE820000-0x000007FEFE8FB000-memory.dmp
memory/1328-57-0x000007FEFAFB0000-0x000007FEFB04C000-memory.dmp
memory/1328-72-0x00000000000E0000-0x0000000000123000-memory.dmp
memory/1328-71-0x000007FEF69E0000-0x000007FEF6B0C000-memory.dmp
memory/1328-70-0x0000000000E90000-0x000000000108A000-memory.dmp
memory/1328-69-0x000007FEFBA40000-0x000007FEFBA96000-memory.dmp
memory/1328-68-0x000007FEFD700000-0x000007FEFD903000-memory.dmp
memory/1328-67-0x000007FEFD910000-0x000007FEFDA3D000-memory.dmp
memory/1328-66-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp
memory/1688-122-0x000000000264B000-0x000000000266A000-memory.dmp
memory/1688-121-0x0000000002644000-0x0000000002647000-memory.dmp
memory/1688-120-0x0000000002644000-0x0000000002647000-memory.dmp
memory/1688-119-0x000007FEEBB10000-0x000007FEEC66D000-memory.dmp
memory/1688-117-0x000007FEEC670000-0x000007FEED093000-memory.dmp
memory/1736-85-0x000000000267B000-0x000000000269A000-memory.dmp
memory/1736-84-0x000000000267B000-0x000000000269A000-memory.dmp
memory/1736-83-0x0000000002674000-0x0000000002677000-memory.dmp
memory/1736-82-0x000000001B730000-0x000000001BA2F000-memory.dmp
memory/1736-81-0x000007FEF4F70000-0x000007FEF5ACD000-memory.dmp
memory/1736-80-0x000007FEF5AD0000-0x000007FEF64F3000-memory.dmp
memory/1736-74-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp