9129967bfcf44c87ec6eb83a30f5500a5e453c76281b7ec3b0c1caa778377e08

Analysis

max time kernel
153s
max time network
62s
platform
windows7_x64
resource
win7v200722
submitted
07/08/2020, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
081t.bin.exe
Size 706KB
Sample200807-b72thhm852
SHA256 9129967bfcf44c87ec6eb83a30f5500a5e453c76281b7ec3b0c1caa778377e08
MD5 d84957ea7aff782ebb5774f286a99511
SHA1 3a7944b6167d837714ff096c77a43ebb8a35c6a5
SHA512 212e6caebbf6437e7fcf7ceffe5fc6870b98b65a1c68c6164070922da99ee0e5d147cdcd8ad5fd3d3542ce4e55d5c8d9ac2ba0df0bef0fbf690645fb833ce8ea
MD5 SHA1 SHA512

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1452	081t.bin.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroCop.lnk	081t.bin.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop	081t.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wl.jpg"	081t.bin.exe

C:\Users\Admin\AppData\Local\Temp\081t.bin.exe
"C:\Users\Admin\AppData\Local\Temp\081t.bin.exe"
1⤵
- Loads dropped DLL
- Drops startup file
- Modifies Control Panel
- Sets desktop wallpaper using registry
PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads