Overview

overview

10

Static

static

8

03ff897da4...b3.exe

windows7_x64

7

03ff897da4...b3.exe

windows10_x64

7

10493d98a6...41.exe

windows7_x64

7

10493d98a6...41.exe

windows10_x64

7

11747d3247...67.exe

windows7_x64

7

11747d3247...67.exe

windows10_x64

San11 Tc/D...eg.htm

windows7_x64

1

San11 Tc/D...eg.htm

windows10_x64

1

San11 Tc/DrvMgt.dll

windows7_x64

1

San11 Tc/DrvMgt.dll

windows10_x64

1

San11 Tc/L...es.exe

windows7_x64

1

San11 Tc/L...es.exe

windows10_x64

1

San11 Tc/S...er.exe

windows7_x64

1

San11 Tc/S...er.exe

windows10_x64

1

San11 Tc/S...er.exe

windows7_x64

1

San11 Tc/S...er.exe

windows10_x64

1

San11 Tc/S...YS.exe

windows7_x64

San11 Tc/S...YS.exe

windows10_x64

San11 Tc/San11.exe

windows7_x64

8

San11 Tc/San11.exe

windows10_x64

8

San11 Tc/san11pk.exe

windows7_x64

3

San11 Tc/san11pk.exe

windows10_x64

1

San11 Tc/�...��.exe

windows7_x64

3

San11 Tc/�...��.exe

windows10_x64

10

23c9e16cc6...7b.exe

windows7_x64

5

23c9e16cc6...7b.exe

windows10_x64

5

36a18ae31f...d0.exe

windows7_x64

7

36a18ae31f...d0.exe

windows10_x64

7

4109a062b3...d4.exe

windows7_x64

8

4109a062b3...d4.exe

windows10_x64

8

CW3.exe

windows7_x64

1

CW3.exe

windows10_x64

1

Analysis

  • max time kernel
    29s
  • max time network
    54s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    20-10-2021 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    San11 Tc/san11pk.exe

  • Size

    152.5MB

  • MD5

    5183312eb33a7556fb5d8de8ca2fae91

  • SHA1

    a5181c63f29d6fcf79bdc3d69780109654dd70d1

  • SHA256

    30d33b44876b84a8e87570873a86de88c65d2491c7e1cdeeb5883dc4b12feefb

  • SHA512

    2959710ac520b8fca69461c03f1206c74e75364c2794c81b4e98aa8e56e291d6816927fdbb38069693f3dca15131eabab2a0d643e555f7fe46db108ee3f9b54e

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\San11 Tc\san11pk.exe
    "C:\Users\Admin\AppData\Local\Temp\San11 Tc\san11pk.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1468-54-0x0000000075C11000-0x0000000075C13000-memory.dmp
    Filesize

    8KB

    Download