Overview

overview

6

Static

static

3

20ed21bfdb...5d.exe

windows7-x64

1

20ed21bfdb...5d.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2025, 17:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe
  • Size 5.2MB
  • Sample250112-wd1gjaslax
  • SHA256 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
executionransomware

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe
    "C:\Users\Admin\AppData\Local\Temp\20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe"
    1⤵
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\system32\net.exe
      "net" session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2204
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4008
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "wevtutil sl Security /e:false"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Windows\system32\wevtutil.exe
          "C:\Windows\system32\wevtutil.exe" sl Security /e:false
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:628
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "wevtutil sl Application /e:false"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\Windows\system32\wevtutil.exe
          "C:\Windows\system32\wevtutil.exe" sl Application /e:false
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4132

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 00ae5433c0107cc164516c7849b4cff7b6faeb52e5afa65c01dbd8c7a5efe397
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 0c451ff3823450d544066237cbfb08556b7ca36c4a0ea085055f69ab35795b00
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_4qrem1dx.sgu.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4qrem1dx.sgu.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          memory/2732-43-0x00007FFB89CE0000-0x00007FFB8A7A1000-memory.dmp
          Download

          memory/2732-46-0x00007FFB89CE0000-0x00007FFB8A7A1000-memory.dmp
          Download

          memory/2732-33-0x00007FFB89CE0000-0x00007FFB8A7A1000-memory.dmp
          Download

          memory/2732-57-0x00007FFB89CE0000-0x00007FFB8A7A1000-memory.dmp
          Download

          memory/3852-2-0x00007FFB89CE3000-0x00007FFB89CE5000-memory.dmp
          Download

          memory/3852-23-0x00007FFB89CE0000-0x00007FFB8A7A1000-memory.dmp
          Download

          memory/3852-9-0x00000218E7D40000-0x00000218E7D62000-memory.dmp
          Download

          memory/3852-62-0x00007FFB89CE0000-0x00007FFB8A7A1000-memory.dmp
          Download

          memory/3852-3-0x00007FFB89CE0000-0x00007FFB8A7A1000-memory.dmp
          Download