Analysis
- max time kernel
37s - max time network
41s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
30/01/2023, 10:22
General
- Target file.exe
- Size 3.4MB
- Sample230130-md891abf2x
- SHA256 4cafc9c8dfd619014def47bb4a50931adf151c3733ea793fd157111a4c90b490
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SRIKA" /tr "C:\ProgramData\versionApp\SRIKA.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SRIKA" /tr "C:\ProgramData\versionApp\SRIKA.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1284 -s 15122⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/568-81-0x000000000289B000-0x00000000028BA000-memory.dmp
memory/568-80-0x0000000002894000-0x0000000002897000-memory.dmp
memory/568-78-0x000007FEECFD0000-0x000007FEEDB2D000-memory.dmp
memory/568-79-0x0000000002894000-0x0000000002897000-memory.dmp
memory/568-77-0x000007FEEDB30000-0x000007FEEE553000-memory.dmp
memory/568-75-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp
memory/1284-66-0x0000000001100000-0x0000000001544000-memory.dmp
memory/1284-58-0x0000000077490000-0x000000007758A000-memory.dmp
memory/1284-64-0x000007FEFD8B0000-0x000007FEFD98B000-memory.dmp
memory/1284-55-0x000007FEFB160000-0x000007FEFB1CF000-memory.dmp
memory/1284-67-0x0000000000520000-0x0000000000561000-memory.dmp
memory/1284-65-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp
memory/1284-68-0x000007FEFF890000-0x000007FEFF9BD000-memory.dmp
memory/1284-69-0x000007FEFDAA0000-0x000007FEFDCA3000-memory.dmp
memory/1284-70-0x0000000001100000-0x0000000001544000-memory.dmp
memory/1284-71-0x000007FEF6A30000-0x000007FEF6B5C000-memory.dmp
memory/1284-72-0x000007FEFCE40000-0x000007FEFCE62000-memory.dmp
memory/1284-73-0x000007FEFCCF0000-0x000007FEFCD07000-memory.dmp
memory/1284-62-0x000007FEFDFF0000-0x000007FEFE061000-memory.dmp
memory/1284-61-0x000007FEFD660000-0x000007FEFD6CC000-memory.dmp
memory/1284-76-0x000007FEFF610000-0x000007FEFF6E7000-memory.dmp
memory/1284-60-0x0000000077590000-0x00000000776AF000-memory.dmp
memory/1284-59-0x000007FEFF570000-0x000007FEFF60F000-memory.dmp
memory/1284-63-0x000007FEF6C90000-0x000007FEF6D87000-memory.dmp
memory/1284-57-0x000007FEFDCB0000-0x000007FEFDD17000-memory.dmp
memory/1284-56-0x000007FEFAED0000-0x000007FEFAF6C000-memory.dmp
memory/1284-82-0x0000000000520000-0x0000000000561000-memory.dmp
memory/1284-97-0x000007FEEE5C0000-0x000007FEEE6F8000-memory.dmp
memory/1284-96-0x000007FEFCB10000-0x000007FEFCB6B000-memory.dmp
memory/1284-85-0x000007FEFBA70000-0x000007FEFBC85000-memory.dmp
memory/1284-87-0x000007FEFE1D0000-0x000007FEFE1EF000-memory.dmp
memory/1284-88-0x000007FEF1420000-0x000007FEF143C000-memory.dmp
memory/1284-89-0x000007FEF1440000-0x000007FEF14A2000-memory.dmp
memory/1284-90-0x000007FEFE200000-0x000007FEFE24D000-memory.dmp
memory/1284-91-0x000007FEFA4B0000-0x000007FEFA514000-memory.dmp
memory/1284-92-0x000007FEFA540000-0x000007FEFA5B1000-memory.dmp
memory/1284-93-0x000007FEFD2C0000-0x000007FEFD2E5000-memory.dmp
memory/1284-94-0x000007FEFB030000-0x000007FEFB057000-memory.dmp
memory/1284-95-0x000007FEFD6E0000-0x000007FEFD716000-memory.dmp