Analysis
- max time kernel
57s - max time network
94s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
02/12/2022, 23:34
General
- Target file.exe
- Size 1.4MB
- Sample221202-3kelzaee47
- SHA256 194ebdc17146fb4fca3f3ee63480221bbc434961d48d3f7af4d5f0eadcc4d956
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9FAA.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\netcore\PWOJ.exe"C:\ProgramData\netcore\PWOJ.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PWOJ" /tr "C:\ProgramData\netcore\PWOJ.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PWOJ" /tr "C:\ProgramData\netcore\PWOJ.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1972 -s 15364⤵
- Loads dropped DLL
- Program crash
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
PWOJ.exe
PWOJ.exe
tmp9FAA.tmp.bat
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
PWOJ.exe
PWOJ.exe
PWOJ.exe
PWOJ.exe
memory/648-86-0x0000000002414000-0x0000000002417000-memory.dmp
memory/648-133-0x000000001B770000-0x000000001BA6F000-memory.dmp
memory/648-139-0x0000000002414000-0x0000000002417000-memory.dmp
memory/648-131-0x0000000002414000-0x0000000002417000-memory.dmp
memory/648-76-0x000007FEECCA0000-0x000007FEED6C3000-memory.dmp
memory/648-84-0x000007FEF5F80000-0x000007FEF6ADD000-memory.dmp
memory/648-141-0x000000000241B000-0x000000000243A000-memory.dmp
memory/648-74-0x000007FEFC281000-0x000007FEFC283000-memory.dmp
memory/968-124-0x0000000002384000-0x0000000002387000-memory.dmp
memory/968-128-0x000000001B7F0000-0x000000001BAEF000-memory.dmp
memory/968-122-0x000007FEECCA0000-0x000007FEED6C3000-memory.dmp
memory/968-144-0x000000000238B000-0x00000000023AA000-memory.dmp
memory/968-125-0x000007FEF5F80000-0x000007FEF6ADD000-memory.dmp
memory/968-143-0x0000000002384000-0x0000000002387000-memory.dmp
memory/1800-140-0x000000000241B000-0x000000000243A000-memory.dmp
memory/1800-134-0x000000001B7A0000-0x000000001BA9F000-memory.dmp
memory/1800-123-0x0000000002414000-0x0000000002417000-memory.dmp
memory/1800-137-0x0000000002414000-0x0000000002417000-memory.dmp
memory/1800-126-0x000007FEF5F80000-0x000007FEF6ADD000-memory.dmp
memory/1800-120-0x000007FEECCA0000-0x000007FEED6C3000-memory.dmp
memory/1972-110-0x000007FEF3ED0000-0x000007FEF3FFC000-memory.dmp
memory/1972-146-0x000007FEFD040000-0x000007FEFD057000-memory.dmp
memory/1972-97-0x000007FEFE430000-0x000007FEFE4CF000-memory.dmp
memory/1972-98-0x00000000777E0000-0x00000000778FF000-memory.dmp
memory/1972-100-0x000007FEFF8C0000-0x000007FEFF931000-memory.dmp
memory/1972-99-0x000007FEFDAD0000-0x000007FEFDB3C000-memory.dmp
memory/1972-101-0x000007FEF6C90000-0x000007FEF6D87000-memory.dmp
memory/1972-102-0x000007FEFE350000-0x000007FEFE42B000-memory.dmp
memory/1972-104-0x0000000000150000-0x0000000000326000-memory.dmp
memory/1972-103-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp
memory/1972-106-0x00000000000E0000-0x0000000000123000-memory.dmp
memory/1972-107-0x000007FEFFAC0000-0x000007FEFFCC3000-memory.dmp
memory/1972-108-0x0000000000150000-0x0000000000326000-memory.dmp
memory/1972-105-0x000007FEFF990000-0x000007FEFFABD000-memory.dmp
memory/1972-156-0x000007FEF33A0000-0x000007FEF34D8000-memory.dmp
memory/1972-109-0x0000000000150000-0x0000000000326000-memory.dmp
memory/1972-95-0x000007FEFE2E0000-0x000007FEFE347000-memory.dmp
memory/1972-94-0x000007FEF6FD0000-0x000007FEF706C000-memory.dmp
memory/1972-93-0x000007FEF7070000-0x000007FEF70DF000-memory.dmp
memory/1972-155-0x000007FEFCE60000-0x000007FEFCEBB000-memory.dmp
memory/1972-154-0x000007FEFDB50000-0x000007FEFDB86000-memory.dmp
memory/1972-153-0x000007FEFB240000-0x000007FEFB267000-memory.dmp
memory/1972-152-0x000007FEFD610000-0x000007FEFD635000-memory.dmp
memory/1972-151-0x000007FEF9D10000-0x000007FEF9D81000-memory.dmp
memory/1972-150-0x000007FEF9CA0000-0x000007FEF9D04000-memory.dmp
memory/1972-149-0x000007FEFF940000-0x000007FEFF98D000-memory.dmp
memory/1972-148-0x000007FEF16B0000-0x000007FEF1712000-memory.dmp
memory/1972-147-0x000007FEFACD0000-0x000007FEFACEC000-memory.dmp
memory/1972-96-0x0000000077900000-0x00000000779FA000-memory.dmp
memory/1972-118-0x000007FEFBE20000-0x000007FEFC035000-memory.dmp
memory/1972-127-0x000007FEFF6D0000-0x000007FEFF7A7000-memory.dmp
memory/1972-130-0x000007FEFE920000-0x000007FEFE93F000-memory.dmp
memory/1972-145-0x000007FEFD190000-0x000007FEFD1B2000-memory.dmp
memory/1972-135-0x0000000000150000-0x0000000000326000-memory.dmp
memory/1972-136-0x00000000000E0000-0x0000000000123000-memory.dmp
memory/1980-138-0x00000000024B4000-0x00000000024B7000-memory.dmp
memory/1980-129-0x000000001B720000-0x000000001BA1F000-memory.dmp
memory/1980-87-0x00000000024B4000-0x00000000024B7000-memory.dmp
memory/1980-78-0x000007FEECCA0000-0x000007FEED6C3000-memory.dmp
memory/1980-142-0x00000000024BB000-0x00000000024DA000-memory.dmp
memory/1980-85-0x000007FEF5F80000-0x000007FEF6ADD000-memory.dmp
memory/1980-132-0x00000000024B4000-0x00000000024B7000-memory.dmp
memory/1996-69-0x000007FEFFAC0000-0x000007FEFFCC3000-memory.dmp
memory/1996-64-0x000007FEFF8C0000-0x000007FEFF931000-memory.dmp
memory/1996-62-0x00000000005F0000-0x0000000000633000-memory.dmp
memory/1996-60-0x0000000000A90000-0x0000000000C66000-memory.dmp
memory/1996-68-0x000007FEFF990000-0x000007FEFFABD000-memory.dmp
memory/1996-61-0x00000000777E0000-0x00000000778FF000-memory.dmp
memory/1996-70-0x0000000000A90000-0x0000000000C66000-memory.dmp
memory/1996-63-0x000007FEFDAD0000-0x000007FEFDB3C000-memory.dmp
memory/1996-71-0x000007FEF6C60000-0x000007FEF6D8C000-memory.dmp
memory/1996-59-0x000007FEFE430000-0x000007FEFE4CF000-memory.dmp
memory/1996-79-0x000007FEFE920000-0x000007FEFE93F000-memory.dmp
memory/1996-81-0x0000000000A90000-0x0000000000C66000-memory.dmp
memory/1996-82-0x00000000005F0000-0x0000000000633000-memory.dmp
memory/1996-65-0x000007FEF6D90000-0x000007FEF6E87000-memory.dmp
memory/1996-66-0x000007FEFE350000-0x000007FEFE42B000-memory.dmp
memory/1996-55-0x000007FEF7070000-0x000007FEF70DF000-memory.dmp
memory/1996-67-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp
memory/1996-58-0x0000000077900000-0x00000000779FA000-memory.dmp
memory/1996-57-0x000007FEFE2E0000-0x000007FEFE347000-memory.dmp
memory/1996-56-0x000007FEF6FD0000-0x000007FEF706C000-memory.dmp