e084bbd5502e2fe6fd3ac6ad41fc88f2d09ffc89d24e8d34107c83db76d0ff98

Analysis

max time kernel
56s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/02/2023, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d967adbdef503c4d815442dfdcd4faa5.exe
Size 784KB
Sample230215-e7nw6aab53
SHA256 e084bbd5502e2fe6fd3ac6ad41fc88f2d09ffc89d24e8d34107c83db76d0ff98
MD5 d967adbdef503c4d815442dfdcd4faa5
SHA1 d2088284fea378c540aab11c4c33f973a87fd94f
SHA512 84acd4b4f1b3844d3da592aece8bc929afcbb990a74082f86a9d4261f27d56ce0f87b06061d7e2e661459cb1776b94ffe60a9b813f03a2beb7d5935e6685b551
SSDEEP 24576:NYXfQ57jimLrIqM8XE11MJurilvVULV8g:6o5qaXE11UjULKg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1612	d967adbdef503c4d815442dfdcd4faa5.exe
1612	d967adbdef503c4d815442dfdcd4faa5.exe
1612	d967adbdef503c4d815442dfdcd4faa5.exe
1612	d967adbdef503c4d815442dfdcd4faa5.exe
1612	d967adbdef503c4d815442dfdcd4faa5.exe
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	d967adbdef503c4d815442dfdcd4faa5.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1740	1612	d967adbdef503c4d815442dfdcd4faa5.exe	27
PID 1612 wrote to memory of 1740	1612	d967adbdef503c4d815442dfdcd4faa5.exe	27
PID 1612 wrote to memory of 1740	1612	d967adbdef503c4d815442dfdcd4faa5.exe	27
PID 1612 wrote to memory of 1740	1612	d967adbdef503c4d815442dfdcd4faa5.exe	27
PID 1612 wrote to memory of 2020	1612	d967adbdef503c4d815442dfdcd4faa5.exe	29
PID 1612 wrote to memory of 2020	1612	d967adbdef503c4d815442dfdcd4faa5.exe	29
PID 1612 wrote to memory of 2020	1612	d967adbdef503c4d815442dfdcd4faa5.exe	29
PID 1612 wrote to memory of 2020	1612	d967adbdef503c4d815442dfdcd4faa5.exe	29
PID 1612 wrote to memory of 1724	1612	d967adbdef503c4d815442dfdcd4faa5.exe	31
PID 1612 wrote to memory of 1724	1612	d967adbdef503c4d815442dfdcd4faa5.exe	31
PID 1612 wrote to memory of 1724	1612	d967adbdef503c4d815442dfdcd4faa5.exe	31
PID 1612 wrote to memory of 1724	1612	d967adbdef503c4d815442dfdcd4faa5.exe	31
PID 1612 wrote to memory of 1092	1612	d967adbdef503c4d815442dfdcd4faa5.exe	32
PID 1612 wrote to memory of 1092	1612	d967adbdef503c4d815442dfdcd4faa5.exe	32
PID 1612 wrote to memory of 1092	1612	d967adbdef503c4d815442dfdcd4faa5.exe	32
PID 1612 wrote to memory of 1092	1612	d967adbdef503c4d815442dfdcd4faa5.exe	32
PID 1612 wrote to memory of 1872	1612	d967adbdef503c4d815442dfdcd4faa5.exe	33
PID 1612 wrote to memory of 1872	1612	d967adbdef503c4d815442dfdcd4faa5.exe	33
PID 1612 wrote to memory of 1872	1612	d967adbdef503c4d815442dfdcd4faa5.exe	33
PID 1612 wrote to memory of 1872	1612	d967adbdef503c4d815442dfdcd4faa5.exe	33
PID 1612 wrote to memory of 1980	1612	d967adbdef503c4d815442dfdcd4faa5.exe	34
PID 1612 wrote to memory of 1980	1612	d967adbdef503c4d815442dfdcd4faa5.exe	34
PID 1612 wrote to memory of 1980	1612	d967adbdef503c4d815442dfdcd4faa5.exe	34
PID 1612 wrote to memory of 1980	1612	d967adbdef503c4d815442dfdcd4faa5.exe	34
PID 1612 wrote to memory of 1756	1612	d967adbdef503c4d815442dfdcd4faa5.exe	35
PID 1612 wrote to memory of 1756	1612	d967adbdef503c4d815442dfdcd4faa5.exe	35
PID 1612 wrote to memory of 1756	1612	d967adbdef503c4d815442dfdcd4faa5.exe	35
PID 1612 wrote to memory of 1756	1612	d967adbdef503c4d815442dfdcd4faa5.exe	35

C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe
"C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fVYTTjjllR.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fVYTTjjllR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD20F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe
  "C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe"
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe
  "C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe"
  2⤵
  PID:1092
- C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe
  "C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe"
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe
  "C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe"
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe
  "C:\Users\Admin\AppData\Local\Temp\d967adbdef503c4d815442dfdcd4faa5.exe"
  2⤵
  PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpD20F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD20F.tmp
Size 1KB
SHA256 6d9d3dd54f8ef40c99848ec80c447c83bc21260892cd2c17fe789d2d6fd31bd6
MD5 1c0811f4663dde5b0a04490c5b863639
SHA1 2288e54d8bed68ba6f935e8b522a8066546b7ccd
SHA512 f504077b1447be1f26c11404a2093d132be942b972224b9344c04d2b50ca2d605b8ee285d4a15a8277b42d466bf7430dee4280d1686e1b056d8763d533730c42
MD5 SHA1 SHA512

Submit Download

memory/1612-54-0x00000000003D0000-0x000000000049A000-memory.dmp

Download

memory/1612-55-0x0000000075091000-0x0000000075093000-memory.dmp

Download

memory/1612-56-0x00000000002A0000-0x00000000002B4000-memory.dmp

Download

memory/1612-57-0x00000000002D0000-0x00000000002DC000-memory.dmp

Download

memory/1612-58-0x00000000053D0000-0x0000000005454000-memory.dmp

Download

memory/1612-63-0x0000000004D80000-0x0000000004DB8000-memory.dmp

Download

memory/1740-64-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Download

memory/1740-65-0x000000006DA50000-0x000000006DFFB000-memory.dmp

Download