Analysis
-
max time kernel
225s -
max time network
181s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-10-2021 08:29
General
-
Target
IHAransom.exe
-
Size
231KB
-
MD5
5f775c9a9d49013ef37aa7d332327af4
-
SHA1
f96eeeaebef8e4d1ed74f7c557ef2a9d3c021bc8
-
SHA256
6fafb9d3eec58313bfeb572ebeb09739a413b1df2b7755611f06ef62d8c9cf8e
-
SHA512
fb6c0231f4821ded9c1fa7045d2581bd816d9dbe792394742b946f7ba76a06e18b84078bef6e0206f5dff2e42145f6e9f9f43829dc567ca571884b60c745f31f
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IHAransom.exe"C:\Users\Admin\AppData\Local\Temp\IHAransom.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-55-0x0000000000BF0000-0x0000000000BF2000-memory.dmpFilesize
8KB
-
memory/332-54-0x000007FEF1F30000-0x000007FEF2FC6000-memory.dmpFilesize
16.6MB
-
memory/332-56-0x0000000000BF6000-0x0000000000C15000-memory.dmpFilesize
124KB
-
memory/332-57-0x0000000000C15000-0x0000000000C16000-memory.dmpFilesize
4KB
-
memory/332-58-0x0000000000C16000-0x0000000000C17000-memory.dmpFilesize
4KB