Resubmissions
20/03/2021, 12:32
210320-gtx5d6h67a 10Analysis
-
max time kernel
6s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20/03/2021, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe
-
Size
9.8MB
-
MD5
1916caf047d83174cb7ce28d07f54f25
-
SHA1
02ca0f3ad95e5dbf3dfd1272db8cb77e5e6e3f49
-
SHA256
d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94
-
SHA512
99159edf3e297826a1c355e8fcac4d381ec66ad28df8c39fb0ca29119e718d2cb9cb45a3cf6943704916abc4c4c1891b158a99faf15d27bf6257bdaffca18012
Score
10/10
Malware Config
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GrantSave.png => C:\Users\Admin\Pictures\GrantSave.png.DEMON d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe File renamed C:\Users\Admin\Pictures\JoinEdit.png => C:\Users\Admin\Pictures\JoinEdit.png.DEMON d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe File renamed C:\Users\Admin\Pictures\TestUnprotect.png => C:\Users\Admin\Pictures\TestUnprotect.png.DEMON d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe -
Loads dropped DLL 33 IoCs
pid Process 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 1980 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1980 1684 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 26 PID 1684 wrote to memory of 1980 1684 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 26 PID 1684 wrote to memory of 1980 1684 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 26 PID 1684 wrote to memory of 1980 1684 d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe"C:\Users\Admin\AppData\Local\Temp\d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe"C:\Users\Admin\AppData\Local\Temp\d46eaf1ca21fe46e0cde0f28a7db2ee7c34e710d11083472861522f8ccc20a94.exe_.exe"2⤵
- Modifies extensions of user files
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1980
-