Resubmissions

10-06-2024 21:32

240610-1drlvasajl 10

23-04-2021 16:42

210423-hge38eda1j 8

Analysis

  • max time kernel
    113s
  • max time network
    86s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    23-04-2021 16:42

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.14311.14948.exe

  • Size

    2.5MB

  • MD5

    ae8f9d9b8344d52f0872dfdc852e1dd4

  • SHA1

    7e9f4259cc193465317ee48b8428b36e74028390

  • SHA256

    95b5d0e36464afc8391a9d056926e5859506ead18937669554bde42f7a6d135b

  • SHA512

    27928930215dbb9217247d846c570a756b46866b17b0832c9de7c8a800e3d0457f64c28ddfb4a66372f3837695e8f1a5645804f222ac7344284facb68bc79b21

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.14311.14948.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.14311.14948.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:296
    • C:\Users\Admin\AppData\Roaming\CachemanControlPanel\CachemanControlPanel.exe
      C:\Users\Admin\AppData\Roaming\CachemanControlPanel\CachemanControlPanel.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/296-59-0x00000000757E1000-0x00000000757E3000-memory.dmp

    Filesize

    8KB