Analysis
-
max time kernel
136s -
max time network
129s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-05-2020 13:29
General
-
Target
buer.exe
-
Size
111KB
-
MD5
f884618092b55e3edc48096757aab143
-
SHA1
0c0ad1301fc561699dba22cc779decc0df5570a1
-
SHA256
6728db086194c2fa6a8e17e7b13bac1f5329b501e6f93b3587416895d387d343
-
SHA512
195f4995907e34867d72778fb7e5857ea16e802376cf7ef17e2af3afa64e929bacfed4ed1b60d71a1ad8ea29e47c795c97ee7e41b6a02db59c9cc68fbb32e6ad
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\buer.exe"C:\Users\Admin\AppData\Local\Temp\buer.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\buer.exe"C:\Users\Admin\AppData\Local\Temp\buer.exe"2⤵
-