Analysis
-
max time kernel
377s -
max time network
403s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 20:55
Behavioral task
behavioral1
Sample
script.exe
Resource
win10v2004-20230221-en
General
-
Target
script.exe
-
Size
7.2MB
-
MD5
75c6ac7bb3d0b958044a5471339f09ce
-
SHA1
4dd81884a4e207c2d5654c0f73b75ab80fff0eba
-
SHA256
cf6d729e294e067ddcdbe54fb9cd82217b457362a64683cbf5ec7661fd57dabf
-
SHA512
c7eee82f7ab80c2c5d1c1424d4e892c98b215debe457f66127a828f59a810fdd82c1f26971a0692f561d70339c895d4d620862d1286f4ba60d368ddae0fcb775
-
SSDEEP
196608:yILv8ZZ5dQmR8dA6lp48Qnf2ODjMnGydS8+lXMruO7WZtHq:RqZ5dQJlpwF3MnG38cMruqs
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Loads dropped DLL 16 IoCs
pid Process 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4784 sc.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1288 NOTEPAD.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe 3976 script.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3976 script.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3388 wrote to memory of 3976 3388 script.exe 87 PID 3388 wrote to memory of 3976 3388 script.exe 87 PID 3976 wrote to memory of 4628 3976 script.exe 88 PID 3976 wrote to memory of 4628 3976 script.exe 88 PID 4628 wrote to memory of 4500 4628 cmd.exe 89 PID 4628 wrote to memory of 4500 4628 cmd.exe 89 PID 4500 wrote to memory of 4640 4500 net.exe 90 PID 4500 wrote to memory of 4640 4500 net.exe 90 PID 3976 wrote to memory of 4656 3976 script.exe 91 PID 3976 wrote to memory of 4656 3976 script.exe 91 PID 3976 wrote to memory of 4140 3976 script.exe 93 PID 3976 wrote to memory of 4140 3976 script.exe 93 PID 4140 wrote to memory of 4784 4140 cmd.exe 94 PID 4140 wrote to memory of 4784 4140 cmd.exe 94 PID 3976 wrote to memory of 3012 3976 script.exe 95 PID 3976 wrote to memory of 3012 3976 script.exe 95 PID 3012 wrote to memory of 4368 3012 cmd.exe 96 PID 3012 wrote to memory of 4368 3012 cmd.exe 96 PID 4368 wrote to memory of 2124 4368 net.exe 97 PID 4368 wrote to memory of 2124 4368 net.exe 97 PID 3976 wrote to memory of 4476 3976 script.exe 98 PID 3976 wrote to memory of 4476 3976 script.exe 98 PID 4476 wrote to memory of 3300 4476 cmd.exe 99 PID 4476 wrote to memory of 3300 4476 cmd.exe 99 PID 3300 wrote to memory of 4404 3300 net.exe 100 PID 3300 wrote to memory of 4404 3300 net.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\script.exe"C:\Users\Admin\AppData\Local\Temp\script.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\script.exe"C:\Users\Admin\AppData\Local\Temp\script.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net pause langameservice3⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\system32\net.exenet pause langameservice4⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 pause langameservice5⤵PID:4640
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc delete anydesk3⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\system32\sc.exesc delete anydesk4⤵
- Launches sc.exe
PID:4784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net user User 123123qQ! /add3⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\net.exenet user User 123123qQ! /add4⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user User 123123qQ! /add5⤵PID:2124
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup Администраторы User /add3⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\system32\net.exenet localgroup Администраторы User /add4⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Администраторы User /add5⤵PID:4404
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1012
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\script.bat1⤵
- Opens file in notepad (likely ransom note)
PID:1288
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
81KB
MD54101128e19134a4733028cfaafc2f3bb
SHA166c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA2565843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
SHA5124f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca
-
Filesize
81KB
MD54101128e19134a4733028cfaafc2f3bb
SHA166c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA2565843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
SHA5124f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca
-
Filesize
120KB
MD56a9ca97c039d9bbb7abf40b53c851198
SHA101bcbd134a76ccd4f3badb5f4056abedcff60734
SHA256e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
SHA512dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d
-
Filesize
120KB
MD56a9ca97c039d9bbb7abf40b53c851198
SHA101bcbd134a76ccd4f3badb5f4056abedcff60734
SHA256e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
SHA512dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d
-
Filesize
62KB
MD5de4d104ea13b70c093b07219d2eff6cb
SHA183daf591c049f977879e5114c5fea9bbbfa0ad7b
SHA25639bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
SHA512567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692
-
Filesize
62KB
MD5de4d104ea13b70c093b07219d2eff6cb
SHA183daf591c049f977879e5114c5fea9bbbfa0ad7b
SHA25639bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
SHA512567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692
-
Filesize
154KB
MD5337b0e65a856568778e25660f77bc80a
SHA14d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA256613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
SHA51219e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e
-
Filesize
154KB
MD5337b0e65a856568778e25660f77bc80a
SHA14d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA256613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
SHA51219e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e
-
Filesize
76KB
MD58140bdc5803a4893509f0e39b67158ce
SHA1653cc1c82ba6240b0186623724aec3287e9bc232
SHA25639715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
SHA512d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826
-
Filesize
76KB
MD58140bdc5803a4893509f0e39b67158ce
SHA1653cc1c82ba6240b0186623724aec3287e9bc232
SHA25639715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
SHA512d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826
-
Filesize
155KB
MD5069bccc9f31f57616e88c92650589bdd
SHA1050fc5ccd92af4fbb3047be40202d062f9958e57
SHA256cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
SHA5120e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc
-
Filesize
155KB
MD5069bccc9f31f57616e88c92650589bdd
SHA1050fc5ccd92af4fbb3047be40202d062f9958e57
SHA256cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
SHA5120e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc
-
Filesize
1.7MB
MD5f23aa976990291b68c829198db45cbad
SHA10b3b153a91e6641e90a5f0aae2f7be6082f3c607
SHA256948c75a1351119f9142a72354b2472191af995a95e9bf3ff2b61c031c24bc31d
SHA5124194bd191c927aad8de9b9d8f32a9106fe61e6b63015245388a43b21f39569dc74c4f6c28b3b418aa1512a420829ab519be807a2cd109ed3a91fd44c00110311
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
34KB
MD532d36d2b0719db2b739af803c5e1c2f5
SHA1023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA256128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
SHA512a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1
-
Filesize
34KB
MD532d36d2b0719db2b739af803c5e1c2f5
SHA1023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA256128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
SHA512a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
75KB
MD55e9fc79283d08421683cb9e08ae5bf15
SHA1b3021534d2647d90cd6d445772d2e362a04d5ddf
SHA256d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
SHA5129133011ae8eb0110da9f72a18d26bbc57098a74983af8374d1247b9a336ee32db287ed26f4d010d31a7d64eacdc9cf99a75faab194eff25b04299e5761af1a79
-
Filesize
75KB
MD55e9fc79283d08421683cb9e08ae5bf15
SHA1b3021534d2647d90cd6d445772d2e362a04d5ddf
SHA256d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
SHA5129133011ae8eb0110da9f72a18d26bbc57098a74983af8374d1247b9a336ee32db287ed26f4d010d31a7d64eacdc9cf99a75faab194eff25b04299e5761af1a79
-
Filesize
64KB
MD534e49bb1dfddf6037f0001d9aefe7d61
SHA1a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA2564055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
-
Filesize
64KB
MD534e49bb1dfddf6037f0001d9aefe7d61
SHA1a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA2564055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
-
Filesize
64KB
MD534e49bb1dfddf6037f0001d9aefe7d61
SHA1a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA2564055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
-
Filesize
28KB
MD597ee623f1217a7b4b7de5769b7b665d6
SHA195b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA2560046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
SHA51220edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f
-
Filesize
28KB
MD597ee623f1217a7b4b7de5769b7b665d6
SHA195b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA2560046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
SHA51220edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f
-
Filesize
1.1MB
MD5bc58eb17a9c2e48e97a12174818d969d
SHA111949ebc05d24ab39d86193b6b6fcff3e4733cfd
SHA256ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
SHA5124aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c
-
Filesize
1.1MB
MD5bc58eb17a9c2e48e97a12174818d969d
SHA111949ebc05d24ab39d86193b6b6fcff3e4733cfd
SHA256ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
SHA5124aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c