253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c

Analysis

max time kernel
18s
max time network
74s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cool summer.exe
Size

26KB
MD5

652aecdc55ed88c7ddccda09adda2df1
SHA1

2edf5f1ec2124c94d95e2ccc35146e356d164c31
SHA256

7b77c970b908b1581fcc73f94d99b1c24a0945016448993712d322d1937a5318
SHA512

70a19d30f1a1452c79873a95392f62bc8eaf81545292be6f28f51d8b1060ac35be5d4fc431c4238c7b3fbb3ffa274fce7955c5a4424365a070777a98a41eac63

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

616
616

pid	process
616
616

Suspicious use of SetWindowsHookEx 45 IoCs

Processes:

cool summer.exe

pid	process
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe
1144	cool summer.exe

C:\Users\Admin\AppData\Local\Temp\cool summer.exe
"C:\Users\Admin\AppData\Local\Temp\cool summer.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1144

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-2-0x0000000002341000-0x0000000002349000-memory.dmp

Filesize
32KB

Download
memory/1144-3-0x0000000002C41000-0x0000000002C7B000-memory.dmp

Filesize
232KB

Download