Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-05-2021 12:54
Static task
static1
Behavioral task
behavioral1
Sample
e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe
Resource
win10v20210408
General
-
Target
e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe
-
Size
84KB
-
MD5
be2c93655d951a5cdfb15f2d39f88875
-
SHA1
f0acb609a06865ab84bdfc8c1ffe7e86ebcfbe60
-
SHA256
e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e
-
SHA512
69fcd82da80c23f54a2a3cecd6539ce5d83272011f5d04d46719a66a421de33511b1bdb7670b15a37b4e804d79f358b153d3ad9760f0748ea62c7f1cf7d6098f
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
jezxr.exepid process 1620 jezxr.exe -
Loads dropped DLL 2 IoCs
Processes:
e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exepid process 2004 e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe 2004 e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exedescription pid process target process PID 2004 wrote to memory of 1620 2004 e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe jezxr.exe PID 2004 wrote to memory of 1620 2004 e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe jezxr.exe PID 2004 wrote to memory of 1620 2004 e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe jezxr.exe PID 2004 wrote to memory of 1620 2004 e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe jezxr.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe"C:\Users\Admin\AppData\Local\Temp\e855cbde01e9b4e4f87f93046483a265dc36dbe12aa0569e6443e1ad2f5c979e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\jezxr.exe"C:\Users\Admin\AppData\Local\Temp\jezxr.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jezxr.exeMD5
d5e54d5de6efca3a42b3337382d44697
SHA1e9803f1ed55c345a4e03cf0c825451c154c4d3d0
SHA256892a323bcdb79307bde2807fb2577f56a9cf96b0e933b48910944044dbc511ec
SHA51294b680345bfefec67e0e4d702f95e6f3ac2fb751e19e33be2ddc0bcc7a0db36534cf1b4aeb4df6c065666a6a82a1124057f467e024c37da1796bdc00a5343d59
-
C:\Users\Admin\AppData\Local\Temp\jezxr.exeMD5
d5e54d5de6efca3a42b3337382d44697
SHA1e9803f1ed55c345a4e03cf0c825451c154c4d3d0
SHA256892a323bcdb79307bde2807fb2577f56a9cf96b0e933b48910944044dbc511ec
SHA51294b680345bfefec67e0e4d702f95e6f3ac2fb751e19e33be2ddc0bcc7a0db36534cf1b4aeb4df6c065666a6a82a1124057f467e024c37da1796bdc00a5343d59
-
\Users\Admin\AppData\Local\Temp\jezxr.exeMD5
d5e54d5de6efca3a42b3337382d44697
SHA1e9803f1ed55c345a4e03cf0c825451c154c4d3d0
SHA256892a323bcdb79307bde2807fb2577f56a9cf96b0e933b48910944044dbc511ec
SHA51294b680345bfefec67e0e4d702f95e6f3ac2fb751e19e33be2ddc0bcc7a0db36534cf1b4aeb4df6c065666a6a82a1124057f467e024c37da1796bdc00a5343d59
-
\Users\Admin\AppData\Local\Temp\jezxr.exeMD5
d5e54d5de6efca3a42b3337382d44697
SHA1e9803f1ed55c345a4e03cf0c825451c154c4d3d0
SHA256892a323bcdb79307bde2807fb2577f56a9cf96b0e933b48910944044dbc511ec
SHA51294b680345bfefec67e0e4d702f95e6f3ac2fb751e19e33be2ddc0bcc7a0db36534cf1b4aeb4df6c065666a6a82a1124057f467e024c37da1796bdc00a5343d59
-
memory/1620-64-0x0000000000000000-mapping.dmp
-
memory/2004-60-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/2004-61-0x00000000003D0000-0x00000000003E5000-memory.dmpFilesize
84KB