10b7fd0b4c59b3f5584199ef2cbe7b93acfc47300cac47acc9a4ce0dd82701b1

Analysis

max time kernel
53s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/03/2023, 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NXP ALTERHA CHEM U946-874987.exe
Size

1.3MB
MD5

5d5e76e709b1df312317562127d3d0c0
SHA1

7ea6bbc7ec194f2b38abba2b759574e801a824f9
SHA256

f853dbba694560317f4d0673da02ae77afce25d7eb4dc62f02ed0f5c750ce861
SHA512

b52163cbbd7b48a51ed88668c4f424b95961678c91a9e24026b7967fda12bab710b4a86a5e2e075b30082727f34603e35890305c6bb057df62c71aa28c6f0358
SSDEEP

24576:ce12zVZ97Dc+6yvxly1dJquB9SsFOrOHXLzCIrn0WRO5z:ceAR37P0fkoQbO10u

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
1448	powershell.exe
1260	powershell.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe
2000	NXP ALTERHA CHEM U946-874987.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	NXP ALTERHA CHEM U946-874987.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1260	2000	NXP ALTERHA CHEM U946-874987.exe	27
PID 2000 wrote to memory of 1260	2000	NXP ALTERHA CHEM U946-874987.exe	27
PID 2000 wrote to memory of 1260	2000	NXP ALTERHA CHEM U946-874987.exe	27
PID 2000 wrote to memory of 1260	2000	NXP ALTERHA CHEM U946-874987.exe	27
PID 2000 wrote to memory of 1448	2000	NXP ALTERHA CHEM U946-874987.exe	29
PID 2000 wrote to memory of 1448	2000	NXP ALTERHA CHEM U946-874987.exe	29
PID 2000 wrote to memory of 1448	2000	NXP ALTERHA CHEM U946-874987.exe	29
PID 2000 wrote to memory of 1448	2000	NXP ALTERHA CHEM U946-874987.exe	29
PID 2000 wrote to memory of 1336	2000	NXP ALTERHA CHEM U946-874987.exe	31
PID 2000 wrote to memory of 1336	2000	NXP ALTERHA CHEM U946-874987.exe	31
PID 2000 wrote to memory of 1336	2000	NXP ALTERHA CHEM U946-874987.exe	31
PID 2000 wrote to memory of 1336	2000	NXP ALTERHA CHEM U946-874987.exe	31
PID 2000 wrote to memory of 888	2000	NXP ALTERHA CHEM U946-874987.exe	33
PID 2000 wrote to memory of 888	2000	NXP ALTERHA CHEM U946-874987.exe	33
PID 2000 wrote to memory of 888	2000	NXP ALTERHA CHEM U946-874987.exe	33
PID 2000 wrote to memory of 888	2000	NXP ALTERHA CHEM U946-874987.exe	33
PID 2000 wrote to memory of 1500	2000	NXP ALTERHA CHEM U946-874987.exe	34
PID 2000 wrote to memory of 1500	2000	NXP ALTERHA CHEM U946-874987.exe	34
PID 2000 wrote to memory of 1500	2000	NXP ALTERHA CHEM U946-874987.exe	34
PID 2000 wrote to memory of 1500	2000	NXP ALTERHA CHEM U946-874987.exe	34
PID 2000 wrote to memory of 1516	2000	NXP ALTERHA CHEM U946-874987.exe	35
PID 2000 wrote to memory of 1516	2000	NXP ALTERHA CHEM U946-874987.exe	35
PID 2000 wrote to memory of 1516	2000	NXP ALTERHA CHEM U946-874987.exe	35
PID 2000 wrote to memory of 1516	2000	NXP ALTERHA CHEM U946-874987.exe	35
PID 2000 wrote to memory of 1372	2000	NXP ALTERHA CHEM U946-874987.exe	37
PID 2000 wrote to memory of 1372	2000	NXP ALTERHA CHEM U946-874987.exe	37
PID 2000 wrote to memory of 1372	2000	NXP ALTERHA CHEM U946-874987.exe	37
PID 2000 wrote to memory of 1372	2000	NXP ALTERHA CHEM U946-874987.exe	37
PID 2000 wrote to memory of 1200	2000	NXP ALTERHA CHEM U946-874987.exe	36
PID 2000 wrote to memory of 1200	2000	NXP ALTERHA CHEM U946-874987.exe	36
PID 2000 wrote to memory of 1200	2000	NXP ALTERHA CHEM U946-874987.exe	36
PID 2000 wrote to memory of 1200	2000	NXP ALTERHA CHEM U946-874987.exe	36

C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe
"C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cGVWCJazBD.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cGVWCJazBD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp426.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1336
- C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe
  "C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe"
  2⤵
  PID:888
- C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe
  "C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe"
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe
  "C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe"
  2⤵
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe
  "C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe"
  2⤵
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe
  "C:\Users\Admin\AppData\Local\Temp\NXP ALTERHA CHEM U946-874987.exe"
  2⤵
  PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp426.tmp

Filesize
1KB

MD5
d236a67087a3874e3c69586c381106ef

SHA1
0c464878949724e58433cdb9e5818fdf608bb016

SHA256
c378c6cfba4becf217245326f792486937a35dd3138a89f55fc3e010b6f732dc

SHA512
238fd0adbd9fd083a2fde6f52aba99407bb4eefc236fba508ddb2d8bba3c65732f8403aa0b0a88eb39b3583a4fc73787b1182b67cd75d8231f5aded7f32b35ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y2C9IP9ETMVY682Y7JAK.temp

Filesize
7KB

MD5
bcce642b74ccbdc3a9467b87806531cc

SHA1
94baa057215e6e48c2de9ba77161efd2bef49808

SHA256
4dad2eddf60c573c53a57fa3157fb947a633dcbd30bd954b534ab15bfc083870

SHA512
5fbc9fd4eaa9e45435d42a2493959209292e28109017f20b734f9775fa63985008675ff030fd56fd183eb4dcd4dbcd1d474c09f4a71efe527141bacc5614b55c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
bcce642b74ccbdc3a9467b87806531cc

SHA1
94baa057215e6e48c2de9ba77161efd2bef49808

SHA256
4dad2eddf60c573c53a57fa3157fb947a633dcbd30bd954b534ab15bfc083870

SHA512
5fbc9fd4eaa9e45435d42a2493959209292e28109017f20b734f9775fa63985008675ff030fd56fd183eb4dcd4dbcd1d474c09f4a71efe527141bacc5614b55c

Download Submit
memory/1260-73-0x0000000002450000-0x0000000002490000-memory.dmp

Filesize
256KB

Download
memory/1448-72-0x00000000022A0000-0x00000000022E0000-memory.dmp

Filesize
256KB

Download
memory/2000-54-0x00000000003E0000-0x000000000052E000-memory.dmp

Filesize
1.3MB

Download
memory/2000-55-0x0000000004350000-0x0000000004390000-memory.dmp

Filesize
256KB

Download
memory/2000-56-0x0000000000390000-0x00000000003B0000-memory.dmp

Filesize
128KB

Download
memory/2000-57-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2000-58-0x0000000005A70000-0x0000000005B64000-memory.dmp

Filesize
976KB

Download
memory/2000-71-0x0000000005600000-0x0000000005680000-memory.dmp

Filesize
512KB

Download