Analysis
-
max time kernel
153s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe
Resource
win10v2004-20220414-en
General
-
Target
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe
-
Size
1.5MB
-
MD5
67bfea86c243e8501123085e51d7d5e7
-
SHA1
af4571a5feb50748b77b849cac71133df7cf39e4
-
SHA256
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793
-
SHA512
f4dfbe3c74cc60c56a7a37b38edba000366e0b0830b5b6359652f3f9947268a1258a65449f9c0b85545a90761ae5df21a22041d1ce05a1443c2578329cacf159
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Wine 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exedescription ioc process File opened for modification \??\PhysicalDrive0 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exepid process 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exepid process 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exepid process 408 0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe"C:\Users\Admin\AppData\Local\Temp\0ff33e4cbf2cf3f8093c9f702a6e506766477a8e78ac9125416747215a15c793.exe"1⤵
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/408-130-0x0000000000400000-0x00000000007DE000-memory.dmpFilesize
3.9MB