Analysis
- max time kernel
69s - max time network
60s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
03/01/2023, 12:49
General
- Target 2fdf0df1f5229b929069791681fa517f.exe
- Size 580KB
- Sample230103-p2bprabd66
- SHA256 e77f29f3b57b776b5ffb2ed7fdf461702166396172d32809646ef08872894725
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fdf0df1f5229b929069791681fa517f.exe"C:\Users\Admin\AppData\Local\Temp\2fdf0df1f5229b929069791681fa517f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {81851727-1A77-4E5B-AE4C-CD51A7BDFFD9} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\2fdf0df1f5229b929069791681fa517f.exeC:\Users\Admin\AppData\Roaming\2fdf0df1f5229b929069791681fa517f.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 5; Stop-Process 872 -Force; Start-Sleep -Seconds 2; Remove-Item "C:\Users\Admin\AppData\Roaming\2fdf0df1f5229b929069791681fa517f.exe" -Force3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
2fdf0df1f5229b929069791681fa517f.exe
2fdf0df1f5229b929069791681fa517f.exe
590aee7bdd69b59b.customDestinations-ms
2fdf0df1f5229b929069791681fa517f.exe
memory/580-70-0x00000000027E4000-0x00000000027E7000-memory.dmp
memory/580-72-0x000000001B7D0000-0x000000001BACF000-memory.dmp
memory/580-75-0x00000000027EB000-0x000000000280A000-memory.dmp
memory/580-63-0x000007FEFC1E1000-0x000007FEFC1E3000-memory.dmp
memory/580-64-0x000007FEEE780000-0x000007FEEF1A3000-memory.dmp
memory/580-74-0x00000000027E4000-0x00000000027E7000-memory.dmp
memory/580-73-0x00000000027EB000-0x000000000280A000-memory.dmp
memory/580-65-0x000007FEF5F90000-0x000007FEF6AED000-memory.dmp
memory/856-56-0x00000000005F0000-0x0000000000678000-memory.dmp
memory/856-55-0x0000000000540000-0x0000000000546000-memory.dmp
memory/856-54-0x000000013F020000-0x000000013F0B6000-memory.dmp
memory/856-57-0x0000000000550000-0x0000000000556000-memory.dmp
memory/856-60-0x0000000000590000-0x00000000005DC000-memory.dmp
memory/856-58-0x0000000002210000-0x00000000022AE000-memory.dmp
memory/856-59-0x000000001B8C0000-0x000000001B916000-memory.dmp
memory/856-61-0x0000000000920000-0x0000000000974000-memory.dmp
memory/872-71-0x000000013F240000-0x000000013F2D6000-memory.dmp
memory/872-78-0x000000001B906000-0x000000001B925000-memory.dmp
memory/872-76-0x000000001B980000-0x000000001B9D4000-memory.dmp
memory/1876-82-0x000007FEF4240000-0x000007FEF4C63000-memory.dmp
memory/1876-83-0x000007FEF36E0000-0x000007FEF423D000-memory.dmp
memory/1876-84-0x0000000002974000-0x0000000002977000-memory.dmp
memory/1876-85-0x000000000297B000-0x000000000299A000-memory.dmp
memory/1876-86-0x0000000002974000-0x0000000002977000-memory.dmp
memory/1876-87-0x000000000297B000-0x000000000299A000-memory.dmp