Resubmissions

18-01-2023 14:25

230118-rrsavsag38 10

Analysis

  • max time kernel
    20s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    18-01-2023 14:25

General

  • Target

    TA579_20220117/required documents.lnk

  • Size

    2KB

  • MD5

    63406fd9ac6318999606bdf3dee56e59

  • SHA1

    8af67f655ce1b5a1c98a2c3e2dc16b04f524d2ad

  • SHA256

    de6f6037ca98820a57ed73b33a551f33b593ed860e37942c749a1bb1bc12de8d

  • SHA512

    0c287b1a328392bde2560c0afa07119a851788a329bf1f6eceb04f3ea2f56387caac344ff5c8d6f7b3b34e768a16dc67ca637e100da273aa8e1bbf80d3151f61

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\TA579_20220117\required documents.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c pythonw.exe cradle.py & taskkill /F /IM cmd.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Users\Admin\AppData\Local\Temp\TA579_20220117\pythonw.exe
        pythonw.exe cradle.py
        3⤵
          PID:548
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM cmd.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1716

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/548-92-0x0000000000000000-mapping.dmp
    • memory/1128-54-0x000007FEFC071000-0x000007FEFC073000-memory.dmp
      Filesize

      8KB

    • memory/1716-93-0x0000000000000000-mapping.dmp
    • memory/1760-88-0x0000000000000000-mapping.dmp