Analysis

  • max time kernel
    89s
  • max time network
    94s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    03-09-2020 14:53

General

  • Target

    software-launcher.exe

  • Size

    207KB

  • MD5

    900c456cbcd61ed2bf91378112e93eb0

  • SHA1

    c227ca088a4f80729b83396cafa0152d9778254e

  • SHA256

    fd945e2cc6d1b3a453135d5df04eeccbfd16f76e0744dd27b99e0eccaa9053bd

  • SHA512

    e9e71efbe7e70ece0d5022c401d6cb8c808237946b6a30fcfe18d8d43ea93460c04977015daf05a7baa5a9f1467c5ffdcf499a52706c27a0055529a3f38f0ba7

Score
10/10

Malware Config

Signatures

  • HiddenTear Ransomware

    Open-Source ransomware available on Github since 2015, with many versions in the wild.

  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\software-launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\software-launcher.exe"
    1⤵
    • Modifies extensions of user files
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1448-0-0x0000000074360000-0x0000000074A4E000-memory.dmp
    Filesize

    6.9MB

  • memory/1448-1-0x0000000001070000-0x0000000001071000-memory.dmp
    Filesize

    4KB