Overview
overview
10Static
static
20220119_T...ts.lnk
windows7-x64
320220119_T...ts.lnk
windows10-2004-x64
1020220119_T...io.dll
windows7-x64
120220119_T...io.dll
windows10-2004-x64
320220119_T...z2.dll
windows7-x64
120220119_T...z2.dll
windows10-2004-x64
320220119_T...es.dll
windows7-x64
120220119_T...es.dll
windows10-2004-x64
320220119_T...al.dll
windows7-x64
120220119_T...al.dll
windows10-2004-x64
320220119_T...ee.dll
windows7-x64
120220119_T...ee.dll
windows10-2004-x64
320220119_T...ib.dll
windows7-x64
120220119_T...ib.dll
windows10-2004-x64
320220119_T...ma.dll
windows7-x64
120220119_T...ma.dll
windows10-2004-x64
20220119_T...si.dll
windows7-x64
120220119_T...si.dll
windows10-2004-x64
320220119_T...ng.dll
windows7-x64
120220119_T...ng.dll
windows10-2004-x64
320220119_T...ed.dll
windows7-x64
120220119_T...ed.dll
windows10-2004-x64
320220119_T...ue.dll
windows7-x64
120220119_T...ue.dll
windows10-2004-x64
320220119_T...e3.dll
windows7-x64
120220119_T...e3.dll
windows10-2004-x64
320220119_T...sl.dll
windows7-x64
120220119_T...sl.dll
windows10-2004-x64
120220119_T...id.dll
windows7-x64
120220119_T...id.dll
windows10-2004-x64
320220119_T...fo.dll
windows7-x64
120220119_T...fo.dll
windows10-2004-x64
3Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
19-01-2023 16:10
Static task
static1
Behavioral task
behavioral1
Sample
20220119_TA580/Requirements.lnk
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
20220119_TA580/Requirements.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
20220119_TA580/project/_asyncio.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
20220119_TA580/project/_asyncio.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
20220119_TA580/project/_bz2.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
20220119_TA580/project/_bz2.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
20220119_TA580/project/_ctypes.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
20220119_TA580/project/_ctypes.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
20220119_TA580/project/_decimal.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
20220119_TA580/project/_decimal.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
20220119_TA580/project/_elementtree.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
20220119_TA580/project/_elementtree.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
20220119_TA580/project/_hashlib.dll
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
20220119_TA580/project/_hashlib.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
20220119_TA580/project/_lzma.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
20220119_TA580/project/_lzma.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
20220119_TA580/project/_msi.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
20220119_TA580/project/_msi.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
20220119_TA580/project/_multiprocessing.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
20220119_TA580/project/_multiprocessing.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
20220119_TA580/project/_overlapped.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
20220119_TA580/project/_overlapped.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
20220119_TA580/project/_queue.dll
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
20220119_TA580/project/_queue.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
20220119_TA580/project/_sqlite3.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
20220119_TA580/project/_sqlite3.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
20220119_TA580/project/_ssl.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
20220119_TA580/project/_ssl.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
20220119_TA580/project/_uuid.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
20220119_TA580/project/_uuid.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
20220119_TA580/project/_zoneinfo.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
20220119_TA580/project/_zoneinfo.dll
Resource
win10v2004-20221111-en
General
-
Target
20220119_TA580/Requirements.lnk
-
Size
1KB
-
MD5
2157d05171e0a32c30a8c8350d25335a
-
SHA1
3af6b7bcd388b88d71ae09789b18a7a01e23b14b
-
SHA256
6e37e051433faa97a381fc8d8a51e8d0a5384d2fc7abc3dcf727d036bc196a74
-
SHA512
80585b023390d8adbb199e054cc1bfbf82b59c68965b1549f95ae45f33eb1b7f22fa448ff9ed134d6fb04d965216f4a884ed63a6bdbe743c7f5e5233e3b46e5d
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1872 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1872 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 1488 wrote to memory of 776 1488 cmd.exe cmd.exe PID 1488 wrote to memory of 776 1488 cmd.exe cmd.exe PID 1488 wrote to memory of 776 1488 cmd.exe cmd.exe PID 776 wrote to memory of 616 776 cmd.exe pythonw.exe PID 776 wrote to memory of 616 776 cmd.exe pythonw.exe PID 776 wrote to memory of 616 776 cmd.exe pythonw.exe PID 776 wrote to memory of 1872 776 cmd.exe taskkill.exe PID 776 wrote to memory of 1872 776 cmd.exe taskkill.exe PID 776 wrote to memory of 1872 776 cmd.exe taskkill.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\20220119_TA580\Requirements.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd project && pythonw.exe projectt.py & taskkill /F /IM cmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\20220119_TA580\project\pythonw.exepythonw.exe projectt.py3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken