b61654d4440ff18d10ad8a7425493946063c79e233aef6e97d8b6c20d092bda2

Analysis

max time kernel
44s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/01/2023, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
X4Tu5IWZiaomy5r.exe
Size 680KB
Sample230102-v65raafa43
SHA256 b61654d4440ff18d10ad8a7425493946063c79e233aef6e97d8b6c20d092bda2
MD5 61fd0b434aea06bc1d0a9d2e9cae9a93
SHA1 df2261c450ef882338e09310c7d3b3b21d76479a
SHA512 69f5959a509808e7c322c89dbf2fac26bcb1834a65aa88a5e1eb75b1da6603317b4aaa6c40060d91da985e4917fad8973942ab3cded0d6cbb766028f5c889115
SSDEEP 12288:siaSUk7IoMR0t+5w8TWnRHpJnVgM0Hc5h5hivTsM5oRjQx3:siaSUijjfU4RHdhSc5his4QE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
1564	X4Tu5IWZiaomy5r.exe
2024	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	X4Tu5IWZiaomy5r.exe
Token: SeDebugPrivilege	2024	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2024	1564	X4Tu5IWZiaomy5r.exe	28
PID 1564 wrote to memory of 2024	1564	X4Tu5IWZiaomy5r.exe	28
PID 1564 wrote to memory of 2024	1564	X4Tu5IWZiaomy5r.exe	28
PID 1564 wrote to memory of 2024	1564	X4Tu5IWZiaomy5r.exe	28
PID 1564 wrote to memory of 1720	1564	X4Tu5IWZiaomy5r.exe	30
PID 1564 wrote to memory of 1720	1564	X4Tu5IWZiaomy5r.exe	30
PID 1564 wrote to memory of 1720	1564	X4Tu5IWZiaomy5r.exe	30
PID 1564 wrote to memory of 1720	1564	X4Tu5IWZiaomy5r.exe	30
PID 1564 wrote to memory of 1112	1564	X4Tu5IWZiaomy5r.exe	32
PID 1564 wrote to memory of 1112	1564	X4Tu5IWZiaomy5r.exe	32
PID 1564 wrote to memory of 1112	1564	X4Tu5IWZiaomy5r.exe	32
PID 1564 wrote to memory of 1112	1564	X4Tu5IWZiaomy5r.exe	32
PID 1564 wrote to memory of 1996	1564	X4Tu5IWZiaomy5r.exe	33
PID 1564 wrote to memory of 1996	1564	X4Tu5IWZiaomy5r.exe	33
PID 1564 wrote to memory of 1996	1564	X4Tu5IWZiaomy5r.exe	33
PID 1564 wrote to memory of 1996	1564	X4Tu5IWZiaomy5r.exe	33
PID 1564 wrote to memory of 1712	1564	X4Tu5IWZiaomy5r.exe	34
PID 1564 wrote to memory of 1712	1564	X4Tu5IWZiaomy5r.exe	34
PID 1564 wrote to memory of 1712	1564	X4Tu5IWZiaomy5r.exe	34
PID 1564 wrote to memory of 1712	1564	X4Tu5IWZiaomy5r.exe	34
PID 1564 wrote to memory of 1716	1564	X4Tu5IWZiaomy5r.exe	35
PID 1564 wrote to memory of 1716	1564	X4Tu5IWZiaomy5r.exe	35
PID 1564 wrote to memory of 1716	1564	X4Tu5IWZiaomy5r.exe	35
PID 1564 wrote to memory of 1716	1564	X4Tu5IWZiaomy5r.exe	35
PID 1564 wrote to memory of 1956	1564	X4Tu5IWZiaomy5r.exe	36
PID 1564 wrote to memory of 1956	1564	X4Tu5IWZiaomy5r.exe	36
PID 1564 wrote to memory of 1956	1564	X4Tu5IWZiaomy5r.exe	36
PID 1564 wrote to memory of 1956	1564	X4Tu5IWZiaomy5r.exe	36

C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe
"C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kFfBVx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kFfBVx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp952F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe
  "C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe"
  2⤵
  PID:1112
- C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe
  "C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe"
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe
  "C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe"
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe
  "C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe"
  2⤵
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe
  "C:\Users\Admin\AppData\Local\Temp\X4Tu5IWZiaomy5r.exe"
  2⤵
  PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp952F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp952F.tmp
Size 1KB
SHA256 52810beb857147e98a86caac199d74baa0b634b679caca09ca85c68d1e37528f
MD5 464ffaef68137e877c5b750bcdacfe9c
SHA1 7344b82d88d957ada4e9cf1edcff621db1d9f9dc
SHA512 6681a0953643129b06cbee8d7829d5378bd610ff73c0a90e2773cc39997d0c11c68f8732d9ab15bb1268c748f13c4e5fe5fe47900fec1e8069a619e9f7970b10
MD5 SHA1 SHA512

Submit Download

memory/1564-54-0x00000000003A0000-0x0000000000450000-memory.dmp

Download

memory/1564-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Download

memory/1564-56-0x0000000000520000-0x0000000000530000-memory.dmp

Download

memory/1564-57-0x0000000000580000-0x000000000058A000-memory.dmp

Download

memory/1564-58-0x0000000007CB0000-0x0000000007D20000-memory.dmp

Download

memory/1564-63-0x0000000004190000-0x00000000041C6000-memory.dmp

Download

memory/2024-64-0x000000006EA50000-0x000000006EFFB000-memory.dmp

Download

memory/2024-65-0x000000006EA50000-0x000000006EFFB000-memory.dmp

Download