152d5ef19fdfabb482918d51148804bd5227e44e3eb5007dccc347b0ee8585d2

Analysis

max time kernel
253s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe
Size

1.0MB
MD5

d895b9c76dd01f74ed7ac569214bd908
SHA1

c4b0c3e114a9d31d7957f873ee0a87731fd16148
SHA256

152d5ef19fdfabb482918d51148804bd5227e44e3eb5007dccc347b0ee8585d2
SHA512

1a22d896206d1aa1dd40784ba7f2751687c0b1f148620f76b2484e1c105f831d290803cfe28554890ba1055da1eb7e6390cb684c031711cb5d065f0d63d35347
SSDEEP

24576:FSfCp6q+gk0huWQks+28p9NpH6tvqrTlzqepF:FjJc9dks+2O9eVqV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1684 schtasks.exe

pid	process
1684	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe

description	pid	process	target process
PID 516 wrote to memory of 604	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	powershell.exe
PID 516 wrote to memory of 604	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	powershell.exe
PID 516 wrote to memory of 604	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	powershell.exe
PID 516 wrote to memory of 604	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	powershell.exe
PID 516 wrote to memory of 1684	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	schtasks.exe
PID 516 wrote to memory of 1684	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	schtasks.exe
PID 516 wrote to memory of 1684	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	schtasks.exe
PID 516 wrote to memory of 1684	516	SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.8337.19865.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IgppHjCOS.exe"
2⤵
PID:604

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IgppHjCOS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA02.tmp"
2⤵
- Creates scheduled task(s)
PID:1684

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEA02.tmp
Filesize
1KB

MD5
87a6375a0c0db896b0426c12e1ff0052

SHA1
b55e46f98d528f904b9b480f111b3a1e7113592d

SHA256
3835fc9a1cb21e9e8dff1e3c62b77c8c0d264658ac0a8e04e3b2c8ce88b30200

SHA512
ff3c2da0949822571d5a693039405caf81ead239c8e14c0938020baff848a8248ee6e4231a51eb4438a0e6ae13fbfd4164d3ddcffa45fa66a3ba537f360b0be6

Download Submit
memory/516-54-0x0000000000AE0000-0x0000000000BE8000-memory.dmp

Filesize
1.0MB

Download
memory/516-55-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/516-56-0x00000000004B0000-0x00000000004CA000-memory.dmp

Filesize
104KB

Download
memory/516-57-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/516-58-0x0000000007DB0000-0x0000000007E66000-memory.dmp

Filesize
728KB

Download
memory/604-59-0x0000000000000000-mapping.dmp

Download
memory/604-63-0x000000006E890000-0x000000006EE3B000-memory.dmp

Filesize
5.7MB

Download
memory/1684-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads