Analysis
-
max time kernel
26s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-07-2021 11:19
Static task
static1
Behavioral task
behavioral1
Sample
5524836ccb59f40d628f0dd0d8895baa.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5524836ccb59f40d628f0dd0d8895baa.exe
Resource
win10v20210410
General
-
Target
5524836ccb59f40d628f0dd0d8895baa.exe
-
Size
233KB
-
MD5
5524836ccb59f40d628f0dd0d8895baa
-
SHA1
056fa6661b4a0df5e10fe88005bc95a02a15b424
-
SHA256
d223ba3f46e2085a558c1ee3009dfa51dbec2683f500676611f92080fd3d7a2e
-
SHA512
4669c17fd1f7789b53be864c5ef1794c0fec103e1309b9bfd2a282281d70c796ede97277b28fea306718827344faea0213b20a58732bd1c8f81c508d682ab973
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
SmartClock.exepid process 1936 SmartClock.exe -
Drops startup file 1 IoCs
Processes:
5524836ccb59f40d628f0dd0d8895baa.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 5524836ccb59f40d628f0dd0d8895baa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 1936 SmartClock.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5524836ccb59f40d628f0dd0d8895baa.exedescription pid process target process PID 3908 wrote to memory of 1936 3908 5524836ccb59f40d628f0dd0d8895baa.exe SmartClock.exe PID 3908 wrote to memory of 1936 3908 5524836ccb59f40d628f0dd0d8895baa.exe SmartClock.exe PID 3908 wrote to memory of 1936 3908 5524836ccb59f40d628f0dd0d8895baa.exe SmartClock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5524836ccb59f40d628f0dd0d8895baa.exe"C:\Users\Admin\AppData\Local\Temp\5524836ccb59f40d628f0dd0d8895baa.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1936
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
5524836ccb59f40d628f0dd0d8895baa
SHA1056fa6661b4a0df5e10fe88005bc95a02a15b424
SHA256d223ba3f46e2085a558c1ee3009dfa51dbec2683f500676611f92080fd3d7a2e
SHA5124669c17fd1f7789b53be864c5ef1794c0fec103e1309b9bfd2a282281d70c796ede97277b28fea306718827344faea0213b20a58732bd1c8f81c508d682ab973
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
5524836ccb59f40d628f0dd0d8895baa
SHA1056fa6661b4a0df5e10fe88005bc95a02a15b424
SHA256d223ba3f46e2085a558c1ee3009dfa51dbec2683f500676611f92080fd3d7a2e
SHA5124669c17fd1f7789b53be864c5ef1794c0fec103e1309b9bfd2a282281d70c796ede97277b28fea306718827344faea0213b20a58732bd1c8f81c508d682ab973
-
memory/1936-115-0x0000000000000000-mapping.dmp
-
memory/1936-119-0x0000000002CD0000-0x0000000002E1A000-memory.dmpFilesize
1.3MB
-
memory/1936-120-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/3908-114-0x0000000004770000-0x0000000004796000-memory.dmpFilesize
152KB
-
memory/3908-118-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB