Analysis
- max time kernel
40s - max time network
43s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
22/12/2022, 22:31
General
- Target file.exe
- Size 1.8MB
- Sample221222-2fdcnsaf2z
- SHA256 2a7c62fb5cfcb03fa3b5174ab6a68f2b2f0e7391f20d58b07a48bd9c4d224921
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3B4D.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\WindowsMail\AVPTQBAEW.exe"C:\ProgramData\WindowsMail\AVPTQBAEW.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"5⤵
- Creates scheduled task(s)
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
AVPTQBAEW.exe
AVPTQBAEW.exe
tmp3B4D.tmp.bat
590aee7bdd69b59b.customDestinations-ms
AVPTQBAEW.exe
memory/1128-101-0x000007FEF4CF0000-0x000007FEF56DC000-memory.dmp
memory/1128-104-0x000007FEFB540000-0x000007FEFB596000-memory.dmp
memory/1128-124-0x000007FEFC6F0000-0x000007FEFC712000-memory.dmp
memory/1128-120-0x000007FEFEB70000-0x000007FEFEC47000-memory.dmp
memory/1128-125-0x000007FEFC5A0000-0x000007FEFC5B7000-memory.dmp
memory/1128-115-0x000007FEFB130000-0x000007FEFB345000-memory.dmp
memory/1128-126-0x000007FEF9A90000-0x000007FEF9AAC000-memory.dmp
memory/1128-128-0x000007FEFF060000-0x000007FEFF0AD000-memory.dmp
memory/1128-129-0x000007FEFA070000-0x000007FEFA0D4000-memory.dmp
memory/1128-131-0x000007FEFCB70000-0x000007FEFCB95000-memory.dmp
memory/1128-108-0x0000000000840000-0x0000000000A7C000-memory.dmp
memory/1128-135-0x0000000000840000-0x0000000000A7C000-memory.dmp
memory/1128-107-0x00000000004E0000-0x0000000000523000-memory.dmp
memory/1128-103-0x000007FEFEC50000-0x000007FEFEE53000-memory.dmp
memory/1128-105-0x0000000000840000-0x0000000000A7C000-memory.dmp
memory/1128-102-0x000007FEFF0C0000-0x000007FEFF1ED000-memory.dmp
memory/1128-123-0x000007FEFD5C0000-0x000007FEFD5DF000-memory.dmp
memory/1128-99-0x000007FEF6210000-0x000007FEF6307000-memory.dmp
memory/1128-134-0x000007FEFC3C0000-0x000007FEFC41B000-memory.dmp
memory/1128-133-0x000007FEFD0E0000-0x000007FEFD116000-memory.dmp
memory/1128-132-0x000007FEFA650000-0x000007FEFA677000-memory.dmp
memory/1128-127-0x000007FEF0CD0000-0x000007FEF0D32000-memory.dmp
memory/1128-130-0x000007FEFA0E0000-0x000007FEFA151000-memory.dmp
memory/1128-100-0x000007FEFEF80000-0x000007FEFF05B000-memory.dmp
memory/1128-96-0x0000000076D40000-0x0000000076E5F000-memory.dmp
memory/1128-98-0x000007FEFEF00000-0x000007FEFEF71000-memory.dmp
memory/1128-93-0x000007FEFD2E0000-0x000007FEFD347000-memory.dmp
memory/1128-92-0x000007FEF6570000-0x000007FEF660C000-memory.dmp
memory/1128-95-0x000007FEFEE60000-0x000007FEFEEFF000-memory.dmp
memory/1128-94-0x0000000076E60000-0x0000000076F5A000-memory.dmp
memory/1128-91-0x000007FEF6610000-0x000007FEF667F000-memory.dmp
memory/1128-97-0x000007FEFCDC0000-0x000007FEFCE2C000-memory.dmp
memory/1516-55-0x000007FEF6680000-0x000007FEF66EF000-memory.dmp
memory/1516-72-0x000007FEF61E0000-0x000007FEF630C000-memory.dmp
memory/1516-61-0x000007FEFCDC0000-0x000007FEFCE2C000-memory.dmp
memory/1516-76-0x000007FEFD5C0000-0x000007FEFD5DF000-memory.dmp
memory/1516-77-0x00000000002B0000-0x00000000004EC000-memory.dmp
memory/1516-79-0x0000000000210000-0x0000000000253000-memory.dmp
memory/1516-62-0x000007FEFEF00000-0x000007FEFEF71000-memory.dmp
memory/1516-64-0x000007FEFEF80000-0x000007FEFF05B000-memory.dmp
memory/1516-63-0x000007FEF6310000-0x000007FEF6407000-memory.dmp
memory/1516-58-0x0000000076E60000-0x0000000076F5A000-memory.dmp
memory/1516-60-0x0000000076D40000-0x0000000076E5F000-memory.dmp
memory/1516-59-0x000007FEFEE60000-0x000007FEFEEFF000-memory.dmp
memory/1516-66-0x00000000002B0000-0x00000000004EC000-memory.dmp
memory/1516-57-0x000007FEFD2E0000-0x000007FEFD347000-memory.dmp
memory/1516-71-0x00000000002B0000-0x00000000004EC000-memory.dmp
memory/1516-56-0x000007FEF65E0000-0x000007FEF667C000-memory.dmp
memory/1516-70-0x000007FEFB540000-0x000007FEFB596000-memory.dmp
memory/1516-69-0x000007FEFEC50000-0x000007FEFEE53000-memory.dmp
memory/1516-68-0x000007FEFF0C0000-0x000007FEFF1ED000-memory.dmp
memory/1516-67-0x0000000000210000-0x0000000000253000-memory.dmp
memory/1516-65-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp
memory/1740-84-0x0000000002074000-0x0000000002077000-memory.dmp
memory/1740-74-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp
memory/1740-78-0x000007FEEC320000-0x000007FEECD43000-memory.dmp
memory/1740-83-0x0000000002074000-0x0000000002077000-memory.dmp
memory/1740-82-0x000007FEF5570000-0x000007FEF60CD000-memory.dmp
memory/1740-85-0x000000000207B000-0x000000000209A000-memory.dmp
memory/2008-119-0x00000000024C4000-0x00000000024C7000-memory.dmp
memory/2008-114-0x000007FEEB3D0000-0x000007FEEBDF3000-memory.dmp
memory/2008-117-0x000007FEEA870000-0x000007FEEB3CD000-memory.dmp
memory/2008-122-0x00000000024CB000-0x00000000024EA000-memory.dmp
memory/2008-118-0x000000001B710000-0x000000001BA0F000-memory.dmp
memory/2008-121-0x00000000024C4000-0x00000000024C7000-memory.dmp