Analysis
- max time kernel
67s - max time network
58s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
03/01/2023, 14:09
General
- Target 51a709bfee4438611f3afbe3fd4a9257.exe
- Size 580KB
- Sample230103-rf46aabf34
- SHA256 1cf4ca22e9fae2f14ec510910ca68dbe2bdad715af613b391bcb53414ddeb19f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51a709bfee4438611f3afbe3fd4a9257.exe"C:\Users\Admin\AppData\Local\Temp\51a709bfee4438611f3afbe3fd4a9257.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5491C51E-B79D-4CEC-9F4D-BC6808B96BF7} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\51a709bfee4438611f3afbe3fd4a9257.exeC:\Users\Admin\AppData\Roaming\51a709bfee4438611f3afbe3fd4a9257.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 5; Stop-Process 2008 -Force; Start-Sleep -Seconds 2; Remove-Item "C:\Users\Admin\AppData\Roaming\51a709bfee4438611f3afbe3fd4a9257.exe" -Force3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
51a709bfee4438611f3afbe3fd4a9257.exe
51a709bfee4438611f3afbe3fd4a9257.exe
590aee7bdd69b59b.customDestinations-ms
51a709bfee4438611f3afbe3fd4a9257.exe
memory/328-82-0x00000000026C4000-0x00000000026C7000-memory.dmp
memory/328-83-0x00000000026CB000-0x00000000026EA000-memory.dmp
memory/328-81-0x000007FEF3390000-0x000007FEF3EED000-memory.dmp
memory/328-85-0x00000000026CB000-0x00000000026EA000-memory.dmp
memory/328-80-0x000007FEF3EF0000-0x000007FEF4913000-memory.dmp
memory/328-84-0x00000000026C4000-0x00000000026C7000-memory.dmp
memory/1496-63-0x000007FEFC361000-0x000007FEFC363000-memory.dmp
memory/1496-74-0x000000000243B000-0x000000000245A000-memory.dmp
memory/1496-66-0x0000000002434000-0x0000000002437000-memory.dmp
memory/1496-65-0x000007FEF60D0000-0x000007FEF6C2D000-memory.dmp
memory/1496-72-0x000000000243B000-0x000000000245A000-memory.dmp
memory/1496-73-0x0000000002434000-0x0000000002437000-memory.dmp
memory/2008-76-0x000000001B346000-0x000000001B365000-memory.dmp
memory/2008-71-0x000000013F150000-0x000000013F1E6000-memory.dmp
memory/2012-54-0x000000013F2B0000-0x000000013F346000-memory.dmp
memory/2012-61-0x000000001B4A0000-0x000000001B4F4000-memory.dmp
memory/2012-60-0x000000001ACC0000-0x000000001AD0C000-memory.dmp
memory/2012-59-0x00000000024E0000-0x0000000002536000-memory.dmp
memory/2012-58-0x000000001B400000-0x000000001B49E000-memory.dmp
memory/2012-57-0x0000000000550000-0x0000000000556000-memory.dmp
memory/2012-56-0x0000000000960000-0x00000000009E8000-memory.dmp
memory/2012-55-0x0000000000540000-0x0000000000546000-memory.dmp