Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 13:41
Static task
static1
Behavioral task
behavioral1
Sample
dp.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dp.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
dp.exe
-
Size
763KB
-
MD5
0a50081a6cd37aea0945c91de91c5d97
-
SHA1
755309c6d9fa4cd13b6c867cde01cc1e0d415d00
-
SHA256
6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b
-
SHA512
f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
dp.exepid process 1160 dp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dp.exepid process 1160 dp.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
dp.exepid process 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
dp.exepid process 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe 1160 dp.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1160-59-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB