Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7v20201028 - submitted
21/02/2021, 07:39
General
- Target 0a06a353a2e49918aab6f402ba40fa54.exe
- Size 620KB
- Sample210221-pf3ff198w2
- SHA256 d9ac88bfd85d3868d4e732d0a65b3bee2678213467f38aec3c3bd2017355b1ac
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a06a353a2e49918aab6f402ba40fa54.exe"C:\Users\Admin\AppData\Local\Temp\0a06a353a2e49918aab6f402ba40fa54.exe"1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/340-6-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp
memory/1924-2-0x0000000002EA0000-0x0000000002EB1000-memory.dmp
memory/1924-3-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
memory/1924-4-0x0000000000320000-0x00000000003EF000-memory.dmp
memory/1924-5-0x0000000000400000-0x00000000004D5000-memory.dmp