d2dbcfd25b245609cf459f3c646b25e0fdb39da72b3224fd764a054c0d73ce14

Analysis

max time kernel
53s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/01/2023, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3KtIKMVSPNROikR.exe
Size 866KB
Sample230116-nmpsdsec63
SHA256 d2dbcfd25b245609cf459f3c646b25e0fdb39da72b3224fd764a054c0d73ce14
MD5 1eaee46da5cd906f02547cdefd37bd64
SHA1 930097d70f3e636ddcc8acabaf832b9302b3beb9
SHA512 655a4d56054bc92fd5fa05da4600c6ed6b995cff5ce1d41e05762352d1bb176031dc9eeb135da566cdf033998bd37b8689425c99c4db516b7f95ba82d9be5034
SSDEEP 24576:zbLepD6b3ewHdqohovHtozTwj7XZngWnf3rkToZmk53sPD:zbLNb/dovv5l/rTsPD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2032	3KtIKMVSPNROikR.exe
2032	3KtIKMVSPNROikR.exe
2032	3KtIKMVSPNROikR.exe
2032	3KtIKMVSPNROikR.exe
2032	3KtIKMVSPNROikR.exe
2032	3KtIKMVSPNROikR.exe
1696	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	3KtIKMVSPNROikR.exe
Token: SeDebugPrivilege	1696	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1696	2032	3KtIKMVSPNROikR.exe	27
PID 2032 wrote to memory of 1696	2032	3KtIKMVSPNROikR.exe	27
PID 2032 wrote to memory of 1696	2032	3KtIKMVSPNROikR.exe	27
PID 2032 wrote to memory of 1696	2032	3KtIKMVSPNROikR.exe	27
PID 2032 wrote to memory of 1720	2032	3KtIKMVSPNROikR.exe	29
PID 2032 wrote to memory of 1720	2032	3KtIKMVSPNROikR.exe	29
PID 2032 wrote to memory of 1720	2032	3KtIKMVSPNROikR.exe	29
PID 2032 wrote to memory of 1720	2032	3KtIKMVSPNROikR.exe	29
PID 2032 wrote to memory of 288	2032	3KtIKMVSPNROikR.exe	31
PID 2032 wrote to memory of 288	2032	3KtIKMVSPNROikR.exe	31
PID 2032 wrote to memory of 288	2032	3KtIKMVSPNROikR.exe	31
PID 2032 wrote to memory of 288	2032	3KtIKMVSPNROikR.exe	31
PID 2032 wrote to memory of 572	2032	3KtIKMVSPNROikR.exe	32
PID 2032 wrote to memory of 572	2032	3KtIKMVSPNROikR.exe	32
PID 2032 wrote to memory of 572	2032	3KtIKMVSPNROikR.exe	32
PID 2032 wrote to memory of 572	2032	3KtIKMVSPNROikR.exe	32
PID 2032 wrote to memory of 664	2032	3KtIKMVSPNROikR.exe	33
PID 2032 wrote to memory of 664	2032	3KtIKMVSPNROikR.exe	33
PID 2032 wrote to memory of 664	2032	3KtIKMVSPNROikR.exe	33
PID 2032 wrote to memory of 664	2032	3KtIKMVSPNROikR.exe	33
PID 2032 wrote to memory of 1372	2032	3KtIKMVSPNROikR.exe	34
PID 2032 wrote to memory of 1372	2032	3KtIKMVSPNROikR.exe	34
PID 2032 wrote to memory of 1372	2032	3KtIKMVSPNROikR.exe	34
PID 2032 wrote to memory of 1372	2032	3KtIKMVSPNROikR.exe	34
PID 2032 wrote to memory of 1708	2032	3KtIKMVSPNROikR.exe	35
PID 2032 wrote to memory of 1708	2032	3KtIKMVSPNROikR.exe	35
PID 2032 wrote to memory of 1708	2032	3KtIKMVSPNROikR.exe	35
PID 2032 wrote to memory of 1708	2032	3KtIKMVSPNROikR.exe	35

C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe
"C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uxGGwIkCUXY.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uxGGwIkCUXY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB02.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe
  "C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe"
  2⤵
  PID:288
- C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe
  "C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe"
  2⤵
  PID:572
- C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe
  "C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe"
  2⤵
  PID:664
- C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe
  "C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe"
  2⤵
  PID:1372
- C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe
  "C:\Users\Admin\AppData\Local\Temp\3KtIKMVSPNROikR.exe"
  2⤵
  PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpFB02.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpFB02.tmp
Size 1KB
SHA256 947238fce1d6e30e65c4e5b948e857b1660da021f9c936857e48f55e8e2e2c4f
MD5 6870b5cf5c0b152a48da945f2c353b54
SHA1 89f94de5d841f5173f3856744009f29882022d45
SHA512 1cada7c4b98e2a8e25dadaf6f27f004b9ebcdee002465cc317b1d91dd2d7f2f0fa7b451528e873268d1af338e90a4a932f0e8392cebd8d29ee5cf10850c2942a
MD5 SHA1 SHA512

Submit Download

memory/1696-64-0x0000000072D70000-0x000000007331B000-memory.dmp

Download

memory/1696-65-0x0000000072D70000-0x000000007331B000-memory.dmp

Download

memory/2032-54-0x00000000003A0000-0x000000000047E000-memory.dmp

Download

memory/2032-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Download

memory/2032-56-0x0000000000310000-0x0000000000326000-memory.dmp

Download

memory/2032-57-0x0000000000330000-0x000000000033A000-memory.dmp

Download

memory/2032-58-0x00000000057E0000-0x0000000005856000-memory.dmp

Download

memory/2032-63-0x0000000002290000-0x00000000022CE000-memory.dmp

Download