8e6fe812e3f4a19a51a0978e9c47e2cdb891f1feecb0a7ae2c1eff744c971371

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PI#102087.exe
Size

651KB
MD5

505852f2cd67a14131d2d6e927d92889
SHA1

a7062897a84533c30705eb6667d352c78a43b9f6
SHA256

8e6fe812e3f4a19a51a0978e9c47e2cdb891f1feecb0a7ae2c1eff744c971371
SHA512

49709821545b0fb4e7c12ebee2382258def6f5ad9025c91d1ce28bd02b961d8f7c0aed47d2d1a866d5636643d9f13e5a561c872e06e758af2f2f148180bd7585
SSDEEP

12288:sFTYIvM3zrbETClyHskFgFwIyXCDmVRSmMSwOQkL7AiGSdrZOOP55U9smC7B4s:6dU376CoskFgqIyXxv/kiPpZFbU9smCr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

520 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

PI#102087.exe

pid process

1600 PI#102087.exe
1600 PI#102087.exe
1600 PI#102087.exe
1600 PI#102087.exe
1600 PI#102087.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PI#102087.exe

description pid process

Token: SeDebugPrivilege 1600 PI#102087.exe

pid	process
520	schtasks.exe

pid	process
1600	PI#102087.exe
1600	PI#102087.exe
1600	PI#102087.exe
1600	PI#102087.exe
1600	PI#102087.exe

description	pid	process
Token: SeDebugPrivilege	1600	PI#102087.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

PI#102087.exe

description	pid	process	target process
PID 1600 wrote to memory of 520	1600	PI#102087.exe	schtasks.exe
PID 1600 wrote to memory of 520	1600	PI#102087.exe	schtasks.exe
PID 1600 wrote to memory of 520	1600	PI#102087.exe	schtasks.exe
PID 1600 wrote to memory of 520	1600	PI#102087.exe	schtasks.exe
PID 1600 wrote to memory of 1764	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1764	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1764	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1764	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1780	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1780	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1780	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1780	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 308	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 308	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 308	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 308	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1056	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1056	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1056	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1056	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1716	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1716	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1716	1600	PI#102087.exe	PI#102087.exe
PID 1600 wrote to memory of 1716	1600	PI#102087.exe	PI#102087.exe

C:\Users\Admin\AppData\Local\Temp\PI#102087.exe
"C:\Users\Admin\AppData\Local\Temp\PI#102087.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZqcivZeoGSZA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9001.tmp"
2⤵
- Creates scheduled task(s)
PID:520

C:\Users\Admin\AppData\Local\Temp\PI#102087.exe
"{path}"
2⤵
PID:1764

C:\Users\Admin\AppData\Local\Temp\PI#102087.exe
"{path}"
2⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\PI#102087.exe
"{path}"
2⤵
PID:308

C:\Users\Admin\AppData\Local\Temp\PI#102087.exe
"{path}"
2⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\PI#102087.exe
"{path}"
2⤵
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9001.tmp

Filesize
1KB

MD5
4bab19c412f110e7d3ac04a7b051aebb

SHA1
19820c258a7e494e01e8ece8051c5c2476d37b96

SHA256
360cba20d343a28f054a839bfdede675dace9e138ff05777bef1965d6b4e091c

SHA512
a4727b767b777140bb9a49723ce888141869cf094da989e8a5bf09971d85304ffdd48b810d3b71cfd0b70e85c55d81ce6b0a349e734f27ba9a4134c35598f475

Download Submit
memory/520-59-0x0000000000000000-mapping.dmp

Download
memory/1600-54-0x00000000003B0000-0x0000000000458000-memory.dmp

Filesize
672KB

Download
memory/1600-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1600-56-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1600-57-0x0000000004AF0000-0x0000000004B72000-memory.dmp

Filesize
520KB

Download
memory/1600-58-0x0000000000640000-0x000000000067C000-memory.dmp

Filesize
240KB

Download