edf98c8d92926d258cf70c2348ab4c68d31b377cd273b0686f12e3545089030b

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60121ea2ab380455f7e143cd9438443e.exe
Size

98KB
MD5

60121ea2ab380455f7e143cd9438443e
SHA1

091fd74c5caebd9f53c34781ad6b0241883fe698
SHA256

b8f7c90cd170ba8c79c472997c17509e2d241a54a9cef7efea4dac23b043afe8
SHA512

3f42a0756999d6441721f8d4663c8af677c895c4e11ddff25d7a1216b3b4a015b7d3763c0e06f616f73eb5e9df3b42e07baf8d5ec910632f3e275c8d2fd388e6
SSDEEP

1536:AnTUL9I230W6mN+ZGCHMNzKR1iFAGGR10p67LsJmFMbchiRO1mbF8VrdCKcl:skC2++p6/PMbcskdhY

Score

9^/10

evasion ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs
evasion ransomware

Indicator Removal
T1070

Processes:

wevtutil.exewevtutil.exewevtutil.exe

pid process

3592 wevtutil.exe
3576 wevtutil.exe
5476 wevtutil.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 ipinfo.io
31 ipinfo.io
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5600 sc.exe

pid	process
3592	wevtutil.exe
3576	wevtutil.exe
5476	wevtutil.exe

flow	ioc
28	ipinfo.io
31	ipinfo.io

pid	process
5600	sc.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exe

pid	process
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe
2260	60121ea2ab380455f7e143cd9438443e.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exewevtutil.exewevtutil.exewevtutil.exe

description	pid	process
Token: SeDebugPrivilege	2260	60121ea2ab380455f7e143cd9438443e.exe
Token: SeSecurityPrivilege	3592	wevtutil.exe
Token: SeBackupPrivilege	3592	wevtutil.exe
Token: SeSecurityPrivilege	3576	wevtutil.exe
Token: SeBackupPrivilege	3576	wevtutil.exe
Token: SeSecurityPrivilege	5476	wevtutil.exe
Token: SeBackupPrivilege	5476	wevtutil.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2260 wrote to memory of 5884	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 5884	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 5884	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 5884 wrote to memory of 3592	5884	cmd.exe	wevtutil.exe
PID 5884 wrote to memory of 3592	5884	cmd.exe	wevtutil.exe
PID 5884 wrote to memory of 3592	5884	cmd.exe	wevtutil.exe
PID 2260 wrote to memory of 5504	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 5504	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 5504	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 5504 wrote to memory of 3576	5504	cmd.exe	wevtutil.exe
PID 5504 wrote to memory of 3576	5504	cmd.exe	wevtutil.exe
PID 5504 wrote to memory of 3576	5504	cmd.exe	wevtutil.exe
PID 2260 wrote to memory of 3732	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 3732	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 3732	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3732 wrote to memory of 5476	3732	cmd.exe	wevtutil.exe
PID 3732 wrote to memory of 5476	3732	cmd.exe	wevtutil.exe
PID 3732 wrote to memory of 5476	3732	cmd.exe	wevtutil.exe
PID 2260 wrote to memory of 4424	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 4424	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 4424	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 4424 wrote to memory of 5600	4424	cmd.exe	sc.exe
PID 4424 wrote to memory of 5600	4424	cmd.exe	sc.exe
PID 4424 wrote to memory of 5600	4424	cmd.exe	sc.exe
PID 2260 wrote to memory of 1660	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 1660	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2260 wrote to memory of 1660	2260	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\60121ea2ab380455f7e143cd9438443e.exe
"C:\Users\Admin\AppData\Local\Temp\60121ea2ab380455f7e143cd9438443e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C wevtutil.exe clear-log Application
2⤵
- Suspicious use of WriteProcessMemory
PID:5884

C:\Windows\SysWOW64\wevtutil.exe
wevtutil.exe clear-log Application
3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C wevtutil.exe clear-log Security
2⤵
- Suspicious use of WriteProcessMemory
PID:5504

C:\Windows\SysWOW64\wevtutil.exe
wevtutil.exe clear-log Security
3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C wevtutil.exe clear-log System
2⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\wevtutil.exe
wevtutil.exe clear-log System
3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C sc config eventlog start=disabled
2⤵
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\SysWOW64\sc.exe
sc config eventlog start=disabled
3⤵
- Launches sc.exe
PID:5600

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" sc stop eventlog
2⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3868 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-0-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

Filesize
4KB

Download
memory/2260-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-2-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-3-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-4-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-5-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-6-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-7-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-8-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-9-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

Filesize
4KB

Download
memory/2260-10-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-11-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-12-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-13-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-14-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-15-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-16-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-17-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2260-18-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download