Overview

overview

5

Static

static

sample.exe

windows7_x64

5

sample.exe

windows10_x64

5

Resubmissions

28-08-2022 23:26

220828-3e8ymagabq 5

10-06-2021 11:42

210610-j9y37a6cma 5

10-06-2021 11:31

210610-k9s461t52a 5

Analysis

  • max time kernel
    150s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    10-06-2021 11:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample.exe

  • Size

    2.3MB

  • MD5

    84ffb87cc91d697db2f5685df68de7af

  • SHA1

    4f0360d60b685ed6059d32aef24c6b3cbbd46e9e

  • SHA256

    10bba07a1965c61a2ec05b46331e3eeda3d7bdeb8074c86009dc11f2564048fa

  • SHA512

    c6b178f37b2318b4eeaf1e151cac70a10b0be8eeb0e8153bd324a66314a33dca27e43254518a4b2db2ed5cab31ff836e0fa84e2a8112b67772409d77f39d5e9f

Score
5/10
ransomware

Malware Config

Signatures

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sample.exe
    "C:\Users\Admin\AppData\Local\Temp\sample.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    PID:1696
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1384
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:344
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x550
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:944

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1384-61-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-60-0x0000000075211000-0x0000000075213000-memory.dmp
      Filesize

      8KB

      Download