Overview
overview
10Static
static
7COVA-depen...on.pdf
windows7_x64
1COVA-depen...on.pdf
windows10_x64
1COVA-depen...go.pdf
windows7_x64
1COVA-depen...go.pdf
windows10_x64
1COVA-depen...ar.apk
android_x86
COVA-depen...ar.apk
android_x64
COVA-depen...ar.apk
android_x64
COVA-depen...+.h.js
windows7_x64
1COVA-depen...+.h.js
windows10_x64
1COVA-depen...z3.exe
windows7_x64
1COVA-depen...z3.exe
windows10_x64
1COVA-depen...10.dll
windows7_x64
1COVA-depen...10.dll
windows10_x64
10COVA-depen...4..pyc
windows7_x64
3COVA-depen...4..pyc
windows10_x64
3COVA-depen...-4..py
windows7_x64
3COVA-depen...-4..py
windows10_x64
3COVA-depen...4..pyc
windows7_x64
3COVA-depen...4..pyc
windows10_x64
3COVA-depen...-4..py
windows7_x64
3COVA-depen...-4..py
windows10_x64
3COVA-depen...4..pyc
windows7_x64
3COVA-depen...4..pyc
windows10_x64
3COVA-depen...-4..py
windows7_x64
3COVA-depen...-4..py
windows10_x64
3COVA-depen...4..pyc
windows7_x64
3COVA-depen...4..pyc
windows10_x64
3COVA-depen...-4..py
windows7_x64
3COVA-depen...-4..py
windows10_x64
3COVA-depen...4..pyc
windows7_x64
3COVA-depen...4..pyc
windows10_x64
3COVA-depen...-4..py
windows7_x64
3Analysis
-
max time kernel
120s -
max time network
201s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
02-01-2022 16:49
Behavioral task
behavioral1
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/longversion.pdf
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/longversion.pdf
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova_logo.pdf
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova_logo.pdf
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/src/test/resour.jar.apk
Resource
android-x86-arm
Behavioral task
behavioral6
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/src/test/resour.jar.apk
Resource
android-x64
Behavioral task
behavioral7
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/src/test/resour.jar.apk
Resource
android-x64
Behavioral task
behavioral8
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4.5.0-x64-win/include/z3++.h.js
Resource
win7-en-20211208
Behavioral task
behavioral9
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4.5.0-x64-win/include/z3++.h.js
Resource
win10-en-20211208
Behavioral task
behavioral10
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4.5.0-x64-win/bin/z3.exe
Resource
win7-en-20211208
Behavioral task
behavioral11
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4.5.0-x64-win/bin/z3.exe
Resource
win10-en-20211208
Behavioral task
behavioral12
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4.5.0-x64-win/bin/vcomp110.dll
Resource
win7-en-20211208
Behavioral task
behavioral13
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4.5.0-x64-win/bin/vcomp110.dll
Resource
win10-en-20211208
Behavioral task
behavioral14
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win7-en-20211208
Behavioral task
behavioral15
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win10-en-20211208
Behavioral task
behavioral16
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win7-en-20211208
Behavioral task
behavioral17
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win10-en-20211208
Behavioral task
behavioral18
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win7-en-20211208
Behavioral task
behavioral19
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win10-en-20211208
Behavioral task
behavioral20
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win7-en-20211208
Behavioral task
behavioral21
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win10-en-20211208
Behavioral task
behavioral22
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win7-en-20211208
Behavioral task
behavioral23
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win10-en-20211208
Behavioral task
behavioral24
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win7-en-20211208
Behavioral task
behavioral25
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win10-en-20211208
Behavioral task
behavioral26
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win7-en-20211208
Behavioral task
behavioral27
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win10-en-20211208
Behavioral task
behavioral28
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win7-en-20211208
Behavioral task
behavioral29
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win10-en-20211208
Behavioral task
behavioral30
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win7-en-20211208
Behavioral task
behavioral31
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..pyc
Resource
win10-en-20211208
Behavioral task
behavioral32
Sample
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
Resource
win7-en-20211208
General
-
Target
COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8/cova/localLibs/z3-4..py
-
Size
3KB
-
MD5
8cc7dcccda02d7a0620fe6f9c5a3fb4d
-
SHA1
4cb1ad8bfda229c6b196be1932ad0084b630de61
-
SHA256
07fff2d3f442b3cecf16193b9540a0ae9a8e2f25a73f5b5569c55cb52fdc6d69
-
SHA512
44aa48d8ba5d6fb0e56e6bf92a75074767ddedafafddf29d744ffba420f619a9d65ab6661a061e978dfcd115416f5516e135e6cefea80587585a2db442afeb29
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2880 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\COVA-dependabot-maven-cova-com.fasterxml.jackson.core-jackson-databind-2.9.10.8\cova\localLibs\z3-4..py1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx