Analysis
- max time kernel
159s - max time network
180s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
22/11/2022, 10:34
General
- Target file.exe
- Size 1.4MB
- Sample221122-ml4dqaac38
- SHA256 bf90c1ac3aeec2425d48dd23ead4d7ed927123dfc2e41e2322d0b91d589a50ab
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp74D3.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\winrar\OWT.exe"C:\ProgramData\winrar\OWT.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"5⤵
- Creates scheduled task(s)
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
OWT.exe
OWT.exe
tmp74D3.tmp.bat
590aee7bdd69b59b.customDestinations-ms
OWT.exe
memory/436-84-0x0000000001F44000-0x0000000001F47000-memory.dmp
memory/436-76-0x000007FEFB641000-0x000007FEFB643000-memory.dmp
memory/436-81-0x000007FEF3BD0000-0x000007FEF45F3000-memory.dmp
memory/436-83-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp
memory/436-85-0x000000001B7F0000-0x000000001BAEF000-memory.dmp
memory/436-86-0x0000000001F44000-0x0000000001F47000-memory.dmp
memory/436-87-0x0000000001F4B000-0x0000000001F6A000-memory.dmp
memory/552-124-0x0000000002714000-0x0000000002717000-memory.dmp
memory/552-123-0x000000000271B000-0x000000000273A000-memory.dmp
memory/552-116-0x000007FEEACB0000-0x000007FEEB6D3000-memory.dmp
memory/552-122-0x0000000002714000-0x0000000002717000-memory.dmp
memory/552-125-0x000000000271B000-0x000000000273A000-memory.dmp
memory/552-118-0x000007FEE9200000-0x000007FEE9D5D000-memory.dmp
memory/892-96-0x0000000076CC0000-0x0000000076DBA000-memory.dmp
memory/892-126-0x000007FEFD6D0000-0x000007FEFD7A7000-memory.dmp
memory/892-141-0x00000000001C0000-0x00000000003AC000-memory.dmp
memory/892-140-0x000000001C3A6000-0x000000001C3C5000-memory.dmp
memory/892-139-0x000007FEFC220000-0x000007FEFC27B000-memory.dmp
memory/892-138-0x000007FEFCCC0000-0x000007FEFCCF6000-memory.dmp
memory/892-137-0x000007FEFA6C0000-0x000007FEFA6E7000-memory.dmp
memory/892-136-0x000007FEFC9D0000-0x000007FEFC9F5000-memory.dmp
memory/892-135-0x000007FEF9340000-0x000007FEF93B1000-memory.dmp
memory/892-134-0x000007FEF9200000-0x000007FEF9264000-memory.dmp
memory/892-133-0x000007FEFD230000-0x000007FEFD27D000-memory.dmp
memory/892-132-0x000007FEF0B00000-0x000007FEF0B62000-memory.dmp
memory/892-131-0x000007FEF9FF0000-0x000007FEFA00C000-memory.dmp
memory/892-130-0x000007FEFC400000-0x000007FEFC417000-memory.dmp
memory/892-129-0x000007FEFC550000-0x000007FEFC572000-memory.dmp
memory/892-128-0x000007FEFD430000-0x000007FEFD44F000-memory.dmp
memory/892-94-0x000007FEF63F0000-0x000007FEF648C000-memory.dmp
memory/892-93-0x000007FEFA5D0000-0x000007FEFA63F000-memory.dmp
memory/892-95-0x000007FEFD450000-0x000007FEFD4B7000-memory.dmp
memory/892-127-0x0000000000170000-0x00000000001B3000-memory.dmp
memory/892-97-0x000007FEFD280000-0x000007FEFD31F000-memory.dmp
memory/892-101-0x000007FEF6150000-0x000007FEF6247000-memory.dmp
memory/892-100-0x000007FEFEB40000-0x000007FEFEBB1000-memory.dmp
memory/892-99-0x000007FEFCC50000-0x000007FEFCCBC000-memory.dmp
memory/892-98-0x0000000076BA0000-0x0000000076CBF000-memory.dmp
memory/892-103-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmp
memory/892-102-0x000007FEFD340000-0x000007FEFD41B000-memory.dmp
memory/892-106-0x000007FEFB430000-0x000007FEFB486000-memory.dmp
memory/892-105-0x000007FEFD4C0000-0x000007FEFD6C3000-memory.dmp
memory/892-108-0x00000000001C0000-0x00000000003AC000-memory.dmp
memory/892-107-0x00000000001C0000-0x00000000003AC000-memory.dmp
memory/892-104-0x000007FEFCFA0000-0x000007FEFD0CD000-memory.dmp
memory/892-109-0x000007FEF6020000-0x000007FEF614C000-memory.dmp
memory/892-110-0x0000000000170000-0x00000000001B3000-memory.dmp
memory/892-111-0x00000000001C0000-0x00000000003AC000-memory.dmp
memory/892-121-0x000007FEFB210000-0x000007FEFB425000-memory.dmp
memory/972-64-0x000007FEFEB40000-0x000007FEFEBB1000-memory.dmp
memory/972-74-0x0000000000300000-0x0000000000343000-memory.dmp
memory/972-60-0x0000000076CC0000-0x0000000076DBA000-memory.dmp
memory/972-61-0x000007FEFD280000-0x000007FEFD31F000-memory.dmp
memory/972-59-0x000007FEFD450000-0x000007FEFD4B7000-memory.dmp
memory/972-58-0x000007FEFA5A0000-0x000007FEFA63C000-memory.dmp
memory/972-55-0x000007FEFA640000-0x000007FEFA6AF000-memory.dmp
memory/972-57-0x0000000000300000-0x0000000000343000-memory.dmp
memory/972-62-0x0000000076BA0000-0x0000000076CBF000-memory.dmp
memory/972-73-0x0000000000110000-0x00000000002FC000-memory.dmp
memory/972-56-0x0000000000110000-0x00000000002FC000-memory.dmp
memory/972-63-0x000007FEFCC50000-0x000007FEFCCBC000-memory.dmp
memory/972-78-0x000007FEFD430000-0x000007FEFD44F000-memory.dmp
memory/972-67-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp
memory/972-65-0x000007FEF6430000-0x000007FEF6527000-memory.dmp
memory/972-68-0x000007FEFCFA0000-0x000007FEFD0CD000-memory.dmp
memory/972-69-0x000007FEFD4C0000-0x000007FEFD6C3000-memory.dmp
memory/972-70-0x000007FEFB430000-0x000007FEFB486000-memory.dmp
memory/972-71-0x0000000000110000-0x00000000002FC000-memory.dmp
memory/972-72-0x000007FEF6120000-0x000007FEF624C000-memory.dmp
memory/972-79-0x0000000000110000-0x00000000002FC000-memory.dmp
memory/972-66-0x000007FEFD340000-0x000007FEFD41B000-memory.dmp