Overview

overview

8

Static

static

9f3c1668ee...37.exe

windows7_x64

8

9f3c1668ee...37.exe

windows10-2004_x64

8

Resubmissions

14/03/2022, 17:54

220314-wgxvtaafb4 8

Analysis

  • max time kernel
    4294219s
  • max time network
    177s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    14/03/2022, 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe

  • Size

    490KB

  • MD5

    3b3a50b242841e1789a919b1291051f1

  • SHA1

    7b74a50352bb16ba94201c8a9e35b3c1d8a9dc8c

  • SHA256

    9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37

  • SHA512

    ee56efff743ace5d667536acc2134d1f8add17cf8c19787e37a0b86d1a12cf975a26e8920cdf5b5941b698fc0fc5d1450852f80afef95de0e84f254433e39e77

Score
8/10
ransomware

Malware Config

Signatures

  • Modifies extensions of user files 18 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe
    "C:\Users\Admin\AppData\Local\Temp\9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    PID:964
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1128
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:548
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap31507:124:7zEvent21092 -ad -saa -- "C:\Users\Admin\Desktop\RUSSKIJ VOENNIJ KORABL IDI NAHUJ"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/964-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

    Filesize

    8KB

    Download