6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5

Resubmissions

22/05/2020, 16:28

200522-ysyjrm8xj67

22/05/2020, 16:15

200522-dvss5m5wps7

Analysis

max time kernel
146s
max time network
60s
platform
windows10_x64
resource
win10v200430
submitted
22/05/2020, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5.bin.exe
Size 196KB
Sample200522-dvss5m5wps
SHA256 6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5
MD5 a0d418e31766effadc6a37e81ad21743
SHA1 9ec2753f1a123fcd42d95811e1f3b27547b215d0
SHA512 f11160a126b865e561cd1fc99b5bf25a52bfb0be14fb709ba012a045b26f585456f7f55d2d0a3b5d754e1512771b89d768e40718589fc9c9a16b30c2a07dda74
MD5 SHA1 SHA512

Score

5^/10

ransomware

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3756	6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1.jpg"	6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5.bin.exe

Modifies control panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Desktop\WallpaperStyle = "2"	6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Desktop\TileWallpaper = "2"	6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5.bin.exe

C:\Users\Admin\AppData\Local\Temp\6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6caa53b30e5a22779b159d7bdef67f66aea567b6f93360c3c79b6a2d5a37e9a5.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Sets desktop wallpaper using registry
- Modifies control panel
PID:3756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact