Analysis

  • max time kernel
    13s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    03-09-2020 14:52

General

  • Target

    software-launcher8.exe

  • Size

    338KB

  • MD5

    26cae6fdb074d2e30002351c40aa2b58

  • SHA1

    315dfcb400f3fb36220a91fd9f8b9200366eca56

  • SHA256

    53fd929034ec71904be8ef06d4c42f2467997f16364431cb3e46a24d82bdaf6f

  • SHA512

    d00c0e9a3a5fb93f45b7ddf176fda720ccc6e23dbb0615c63222bdacce2c7f15cb8821488141bf5d4452c4a015f0b6704ce2beda4910a4e8509576fc04425b94

Score
10/10

Malware Config

Signatures

  • HiddenTear Ransomware

    Open-Source ransomware available on Github since 2015, with many versions in the wild.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\software-launcher8.exe
    "C:\Users\Admin\AppData\Local\Temp\software-launcher8.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1492-0-0x0000000000380000-0x0000000000381000-memory.dmp
    Filesize

    4KB

  • memory/1492-1-0x0000000073AF0000-0x00000000741DE000-memory.dmp
    Filesize

    6.9MB

  • memory/1492-2-0x0000000000400000-0x0000000000401000-memory.dmp
    Filesize

    4KB

  • memory/1492-4-0x0000000004FD0000-0x0000000004FE1000-memory.dmp
    Filesize

    68KB